CVE-2026-70619

Name of the Vulnerable Software and Affected Versions Odysseus versions prior to commit bf325f6

Description Authenticated non-admin users can manage server-wide embedding backend configuration because certain endpoint management routes verify session authentication but lack an admin authorization guard. An attacker can provide a controlled URL to overwrite the embedding backend in the endpoint configuration file and process environment. This allows the attacker to intercept all subsequent embedding operations—including chat messages, RAG (Retrieval-Augmented Generation) queries, memory entries, and vault text—which are transmitted in plaintext to the attacker-controlled destination. Alternatively, an attacker can delete the endpoint configuration to cause a denial of service for the embedding service for all users.

Recommendations Update to the version containing commit bf325f6 or later.