CVE-2026-70620

Name of the Vulnerable Software and Affected Versions Odysseus versions prior to commit 87babb5

Description An issue exists where admin-privileged attackers can perform server-side request forgery (SSRF), a technique used to induce the server to make requests to an unintended location. By supplying arbitrary URLs to the embedding endpoint configuration, attackers can probe internal network resources because the system lacks validation for schemes, hosts, IP ranges, or DNS rebinding. This allows the submission of loopback addresses, RFC 1918 ranges (private IP addresses), or link-local addresses through the embedding endpoint API to partially read responses from internal APIs, cloud instance metadata services, and other hosts reachable from the server.

Recommendations Update to the version containing commit 87babb5. Restrict access to the embedding endpoint API to minimize the risk of exploitation.