Threat Intelligence Database

Odysseus before commit bf325f6 has a missing authorization vulnerability that allows authenticated non-admin users to modify server-wide embedding backend configuration. This occurs because endpoint management routes verify session authentication but lack an admin authorization check. Exploitation can lead to embedding data being sent in plaintext to attacker-controlled destinations or denial of embedding services by deleting the configuration.

Odysseus before commit 87babb5 contains a server-side request forgery (SSRF) vulnerability that allows attackers with admin privileges to make the server send requests to internal network resources. This occurs because the embedding endpoint configuration does not validate the scheme, host, IP range, or DNS rebind, enabling attackers to submit loopback, RFC 1918, or link-local addresses. The vulnerability can be used to partially read responses from internal services such as cloud instance metadata APIs and other internal hosts reachable from the server. The CVSS 4.0 score is 6.1, indicating a medium severity issue. No patch or official remediation guidance is currently available.