CVE-2026-16637 affects OPeNDAP Hyrax, an open-source data server for scientific datasets. The vulnerability arises because the software follows HTTP 3xx redirects without validating that the new destination matches the configured allowed hosts list. This allows an attacker to redirect requests to unauthorized internal or external targets. During such redirects, certain user identification headers, including the legacy Echo-Token credential, are forwarded to the redirected endpoint, potentially leaking sensitive authentication information. This flaw enables unauthenticated remote attackers to access internal services and, if a user is authenticated, to obtain credentials that grant access to protected datasets. OPeNDAP released Hyrax version 1.18.0 on July 29, 2026, which addresses these issues. Administrators should review allowed host configurations and limit gateway exposure until the patch is applied.

Successful exploitation allows unauthenticated remote attackers to bypass allowed host restrictions and communicate with unauthorized internal or external systems. This can lead to unauthorized access to internal services not intended to be reachable from the internet. Additionally, if a user is authenticated during exploitation, the attacker may obtain the user's Earthdata identifier and a reusable legacy Echo-Token credential, which could be used to access protected datasets or resources with the affected user's privileges.

A fix for this vulnerability is available in OPeNDAP Hyrax version 1.18.0 and later. Administrators should upgrade to version 1.18.0 or newer to remediate the issue. Until the patch is applied, it is recommended to restrict the exposure of the Hyrax gateway endpoint to trusted networks only and carefully review allowed host configurations to minimize risk.