CVE-2026-16637: Opendap Inc Hyrax-Docker

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.

Affected products

Published 2026-08-07. Last modified 2026-09-08.