CVE-2026-82802: Server-Side Request Forgery in NASA earthdata-search

NASA earthdata-search 1.0.0 contains a server-side request forgery vulnerability in the OpenSearchGranuleSearchLambda function of the granules endpoint. By manipulating the openSearchOsdd argument, an attacker can cause the server to make unintended requests. This vulnerability can be exploited remotely without authentication. The issue affects the serverless/src/openSearchGranuleSearch/handler.js file. Although an exploit is publicly available, no active exploitation has been observed. The product is cloud-hosted, and the vendor has not provided a direct response to the disclosure.

Successful exploitation allows an attacker to induce the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise accessible. This can lead to information disclosure or further attacks depending on the internal network configuration. The vulnerability does not require user interaction or privileges to exploit. No direct evidence of active exploitation in the wild has been reported.

As this is a cloud-hosted service, the vendor typically manages remediation server-side. Patch status is not explicitly confirmed in the advisory; therefore, users should check the vendor's official advisory for current remediation guidance. Since the vendor has not responded publicly, monitoring for updates or applying any vendor-provided patches or mitigations when available is recommended.