OPeNDAP Hyrax contains a Server Side Request Forgery (SSRF) vulnerability that allows attackers to bypass allowed hosts restrictions via unvalidated HTTP redirects. This can cause the application to communicate with unauthorized internal or external systems. Additionally, user authentication headers, including a legacy Echo-Token credential, may be leaked to attacker-controlled endpoints during these redirects. Exploitation could enable unauthenticated attackers to access internal services and disclose credentials of authenticated users. A fix addressing these issues was released in Hyrax version 1.18.0. Until patched, administrators are advised to restrict gateway exposure to trusted networks.