The SSRF vulnerability in Odysseus before commit 87babb5 allows admin-privileged attackers to supply arbitrary URLs to an embedding endpoint configuration without proper validation of scheme, host, IP range, or DNS rebinding. This lack of validation enables the server to be coerced into sending requests to internal network resources, including loopback addresses, RFC 1918 private IP ranges, and link-local addresses. Attackers can leverage this to partially read responses from internal services such as cloud instance metadata endpoints and internal APIs. The vulnerability is classified with a CVSS 4.0 score of 6.1 (medium severity). There is no vendor advisory or patch information available at this time, and the affected versions are not explicitly stated.

An attacker with administrative privileges can exploit this SSRF vulnerability to make the server send unauthorized requests to internal network resources. This can lead to partial disclosure of sensitive information from internal services such as cloud instance metadata APIs and internal APIs. The impact is limited to information disclosure and requires admin-level access to exploit. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict admin access to trusted users only and monitor for suspicious activity related to the embedding endpoint configuration. Avoid exposing internal services that could be accessed via SSRF. Do not rely on this as a sole mitigation; await official patches or updates from the vendor.