CVE-2026-82801

HighCVSS 7.3

Published: 31/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A vulnerability was detected in NASA earthdata-search 1.0.0 in the scaleImage function. Manipulation results in server-side request forgery (SSRF). The attack can be initiated remotely, and the exploit is public.

Risk Assessment

A remote attacker could exploit SSRF to access internal network resources, potentially compromising confidentiality and integrity.

Recommendation

Update the component or implement proper URL validation filters to prevent SSRF.

Other vulnerabilities in NASA earthdata-search

CVE-2026-82802Medium
A server-side request forgery (SSRF) vulnerability was found in NASA earthdata-search 1.0.0 in the OpenSearchGranuleSearchLambda function. Manipulating the openSearchOsdd argument can allow sending requests to arbitrary resources. The attack can be launched remotely and the exploit is public. The vendor did not respond.

Original NVD description (English source)

A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS