CVE-2026-16637 affects OPeNDAP Hyrax, an open-source data server software for remote access to scientific datasets. The vulnerability arises because Hyrax follows HTTP 3xx redirects without verifying that the new destination is within the configured allowed hosts list. This allows an attacker to craft requests causing the server to connect to unauthorized or internal systems (SSRF). Furthermore, during such redirects, certain Earthdata user headers, including the User-Id and a legacy Echo-Token credential, are forwarded to the redirected destination, potentially leaking sensitive authentication information. The main authorization token is correctly stripped, but the legacy credential remains exposed. Successful exploitation can lead to unauthorized internal service access and credential disclosure. The CERT/CC notes no practical solution currently exists, but OPeNDAP is developing a patch expected in version 1.18.0 or later. Until then, administrators should carefully review allowed host configurations and limit gateway endpoint exposure to trusted networks.

An unauthenticated remote attacker can exploit this vulnerability to perform SSRF attacks, accessing internal services that should not be reachable externally. If exploitation occurs while a user is authenticated, the attacker may obtain the user's Earthdata identifier and a reusable legacy credential (Echo-Token), enabling unauthorized access to protected datasets or resources as that user. This can lead to unauthorized data access and potential compromise of internal network resources.

No official patch is confirmed as available yet; OPeNDAP is working on a fix expected in Hyrax version 1.18.0 or later. Until the patch is released, administrators should carefully review and tighten their allowed host configurations to prevent unauthorized redirects. Additionally, it is recommended to limit exposure of the Hyrax gateway endpoint to trusted networks only to reduce the attack surface.