CVE-2026-82802

MediumCVSS 5.3

Published: 31/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A server-side request forgery (SSRF) vulnerability was found in NASA earthdata-search 1.0.0 in the OpenSearchGranuleSearchLambda function. Manipulating the openSearchOsdd argument can allow sending requests to arbitrary resources. The attack can be launched remotely and the exploit is public. The vendor did not respond.

Risk Assessment

A remote SSRF attack could access internal network resources, potentially leading to data leakage or further attacks.

Recommendation

Restrict access to the application and apply network filters, and monitor vendor communications for a fix.

Other vulnerabilities in NASA earthdata-search

CVE-2026-82801High
A vulnerability was detected in NASA earthdata-search 1.0.0 in the scaleImage function. Manipulation results in server-side request forgery (SSRF). The attack can be initiated remotely, and the exploit is public.

Original NVD description (English source)

A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS