CVE-2026-70619

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70619", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-04T20:17:18.296Z", "datePublished": "2026-08-04T21:21:30.095Z", "dateUpdated": "2026-11-08T14:08:27.858Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:08:27.858Z"}, "datePublic": "2026-05-31T00:00:00.000Z", "title": "Odysseus Missing Admin Authorization via Embedding Endpoint Routes", "descriptions": [{"lang": "en", "value": "Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers can supply an attacker-controlled URL to overwrite the embedding backend persisted in the endpoint configuration file and process environment, causing all subsequent embedding operations including chat messages, RAG queries, memory entries, and vault text to be transmitted in plaintext to the attacker-controlled destination, or delete the endpoint configuration to deny embedding service to all users."}], "tags": ["x_open-source"], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "Missing Authorization", "type": "CWE"}]}], "affected": [{"defaultStatus": "affected", "vendor": "odysseus-dev", "product": "odysseus", "packageURL": "pkg:github/odysseus-dev/odysseus", "repo": "https://github.com/odysseus-dev/odysseus", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThan": "bf325f6b2185cb42bc5d8f5713a64aecffb766d4"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "references": [{"url": "https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/", "name": "Researcher Blog", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/odysseus-dev/odysseus/issues/80", "name": "Researcher Disclosure (1)", "tags": ["issue-tracking"]}, {"url": "https://github.com/odysseus-dev/odysseus/issues/132", "name": "Researcher Disclosure (2)", "tags": ["technical-description", "exploit", "issue-tracking"]}, {"url": "https://github.com/odysseus-dev/odysseus/commit/bf325f6b2185cb42bc5d8f5713a64aecffb766d4", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/odysseus-missing-admin-authorization-via-embedding-endpoint-routes", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Darkroom4364", "type": "finder"}, {"lang": "en", "value": "Yunus AYDIN", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:10:16.197281Z", "id": "CVE-2026-70619", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:10:51.551Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70619", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:10:16.197281Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:10:19.664Z"}}], "cna": {"tags": ["x_open-source"], "title": "Odysseus Missing Admin Authorization via Embedding Endpoint Routes", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Darkroom4364"}, {"lang": "en", "type": "finder", "value": "Yunus AYDIN"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/odysseus-dev/odysseus", "vendor": "odysseus-dev", "product": "odysseus", "versions": [{"status": "affected", "version": "0", "lessThan": "bf325f6b2185cb42bc5d8f5713a64aecffb766d4", "versionType": "git"}], "packageURL": "pkg:github/odysseus-dev/odysseus", "defaultStatus": "affected"}], "datePublic": "2026-05-31T00:00:00.000Z", "references": [{"url": "https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/", "name": "Researcher Blog", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/odysseus-dev/odysseus/issues/80", "name": "Researcher Disclosure (1)", "tags": ["issue-tracking"]}, {"url": "https://github.com/odysseus-dev/odysseus/issues/132", "name": "Researcher Disclosure (2)", "tags": ["technical-description", "exploit", "issue-tracking"]}, {"url": "https://github.com/odysseus-dev/odysseus/commit/bf325f6b2185cb42bc5d8f5713a64aecffb766d4", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/odysseus-missing-admin-authorization-via-embedding-endpoint-routes", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers can supply an attacker-controlled URL to overwrite the embedding backend persisted in the endpoint configuration file and process environment, causing all subsequent embedding operations including chat messages, RAG queries, memory entries, and vault text to be transmitted in plaintext to the attacker-controlled destination, or delete the endpoint configuration to deny embedding service to all users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:08:27.858Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70619", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:08:27.858Z", "dateReserved": "2026-08-04T20:17:18.296Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-04T21:21:30.095Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageURL": "pkg:github/odysseus-dev/odysseus", "product": "odysseus", "repo": "https://github.com/odysseus-dev/odysseus", "vendor": "odysseus-dev", "versions": [{"lessThan": "bf325f6b2185cb42bc5d8f5713a64aecffb766d4", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers can supply an attacker-controlled URL to overwrite the embedding backend persisted in the endpoint configuration file and process environment, causing all subsequent embedding operations including chat messages, RAG queries, memory entries, and vault text to be transmitted in plaintext to the attacker-controlled destination, or delete the endpoint configuration to deny embedding service to all users."}, {"lang": "es", "value": "Odysseus antes del commit bf325f6 contiene una vulnerabilidad de autorizaci\u00f3n faltante que permite a usuarios autenticados no administradores gestionar la configuraci\u00f3n del backend de incrustaci\u00f3n a nivel de servidor invocando rutas de gesti\u00f3n de puntos finales que verifican la autenticaci\u00f3n de sesi\u00f3n pero omiten la protecci\u00f3n de autorizaci\u00f3n de administrador. Los atacantes pueden proporcionar una URL controlada por el atacante para sobrescribir el backend de incrustaci\u00f3n persistido en el archivo de configuraci\u00f3n del punto final y el entorno del proceso, provocando que todas las operaciones de incrustaci\u00f3n subsiguientes, incluyendo mensajes de chat, consultas RAG, entradas de memoria y texto de la b\u00f3veda, sean transmitidas en texto plano al destino controlado por el atacante, o eliminar la configuraci\u00f3n del punto final para denegar el servicio de incrustaci\u00f3n a todos los usuarios."}], "id": "CVE-2026-70619", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70619", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:10:16.197281Z", "version": "2.0.3"}}]}, "published": "2026-08-04T22:17:17.573", "references": [{"source": "disclosure@vulncheck.com", "url": "https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/odysseus-dev/odysseus/commit/bf325f6b2185cb42bc5d8f5713a64aecffb766d4"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/odysseus-dev/odysseus/issues/132"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/odysseus-dev/odysseus/issues/80"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/odysseus-missing-admin-authorization-via-embedding-endpoint-routes"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,bf325f6b2185cb42bc5d8f5713a64aecffb766d4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "odysseus", "source": "cna", "vendor": "odysseus-dev"}, "product": "odysseus", "vendor": "odysseus-dev"}], "created": "2026-08-04T22:45:03.800826+00:00", "updated": "2026-08-05T10:18:53.063331+00:00", "vendors": ["odysseus-dev", "odysseus-dev$PRODUCT$odysseus"]}