Loading story…
A high-severity vulnerability tracked as CVE-2026-70619 affected Odysseus before commit bf325f6b2185cb42bc5d8f5713a64aecffb766d4, allowing any authenticated non-admin user to access embedding management routes that lacked an admin authorization check. Reports identified exposed routes under /api/embeddings/*, including endpoint configuration and related model management functions, enabling a regular user to overwrite the server-wide embedding backend with an attacker-controlled URL or delete the configuration entirely. The issue was classified as CWE-862 with a CVSS 3.1 rating of High.
By changing the global embedding endpoint, an attacker could cause subsequent embedding-related content—including chat messages, RAG queries, memory entries, and vault text—to be sent in plaintext to infrastructure they controlled, while deletion of the endpoint could disrupt embedding services for all users. Security reports and the project’s GitHub issues also warned that the endpoint health-check behavior created SSRF risk, aligning with CWE-918, because the server could be induced to make outbound requests to attacker-supplied hosts. Maintainers said they fixed the authorization flaw by adding require_admin to the embeddings router and later added URL validation and other SSRF hardening for custom embedding endpoints.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry for CVE-2026-70619 was received by disclosure@vulncheck.com. The record describes a missing authorization flaw in Odysseus before commit bf325f6 that lets authenticated non-admin users manage embedding endpoint routes, enabling data exposure and denial of service.
A public write-up documenting broken access control and SSRF in the Odysseus embedding endpoint was published at aydinnyunus.github.io. The CVE record later referenced this write-up as part of the vulnerability documentation.
On issue #132, collaborator NicholaiVogel stated that the non-admin access problem appeared fixed on the main branch by commit bf325f6 and said issue #80 had been closed for the authentication fix. He also noted that URL validation for the server-side probe remained unresolved.
Aydinnyunus opened GitHub issue #132 describing improper authentication in Odysseus embeddings management routes that let a non-admin user change the global embedding endpoint, persist malicious configuration, exfiltrate plaintext embedding-related data, and trigger SSRF and denial-of-service conditions. The report included proof-of-concept details and recommended adding admin checks and URL validation.
Darkroom4364 opened GitHub issue #80 reporting that Odysseus /api/embeddings/* routes were accessible to authenticated non-admin users, allowing changes to shared embedding configuration and assets. The report recommended requiring admin privileges and adding regression tests.
A collaborator stated that Odysseus had fixed both the improper-authentication and SSRF components on main. Maintainers said POST /api/embeddings/endpoint now validates URLs before outbound health checks and rejects non-HTTP(S) schemes and several unsafe address classes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceaydinnyunus.github.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity vulnerabilities in **Open WebUI** allow attackers to plant malicious chat content that executes when viewed, leading to theft of JWTs and session tokens from `localStorage`, full account takeover, and compromise of sensitive AI assets. The flaws affect markdown rendering, citation and response iframe handling, and HTML file-serving paths, including cases where attacker-controlled content was rendered with dangerous HTML processing or iframe sandbox settings such as `allow-scripts allow-forms allow-same-origin`. Reported impacts include exposure of DOM data, `indexedDB`, cookies, backend API keys, model parameter files, private databases, and other enterprise AI resources. Several reports warn that if an administrator opens a malicious shared transcript or chat, the attack can escalate from stored XSS to **remote code execution** through Open WebUI's administrative features and Python-based functions or plugins, potentially yielding code execution on the Docker container or local host. The issues were addressed across releases including **v0.6.6** and **v0.7.0** by tightening file ownership checks, removing or making optional same-origin iframe access, and recommending stronger HTML sanitization and restrictive CSP settings; one report also provided a database query to hunt for stored chats containing suspicious `data:text/html` or `javascript:` embed payloads.
Jul 7, 2026
Researchers disclosed multiple high-severity vulnerabilities in the open-source **Voyager** admin package for Laravel, warning that flaws in versions **1.8.0 and earlier** can be chained to achieve **remote code execution** and potentially full system compromise. The reported issues include **CVE-2024-55417**, an arbitrary file upload weakness caused by insufficient MIME-type validation, and **CVE-2024-55416**, a reflected **XSS** flaw in the `/admin/compass` component that can help attackers reach code execution in administrative contexts. The disclosures also describe a file path manipulation issue that can enable unauthorized file read and deletion, expanding the impact beyond code execution to broader application and server compromise. Public reporting said no security update was available at the time of notice, and defenders were urged to treat Voyager deployments as exposed, restrict or avoid use of the package until patches are released, and assess Laravel environments for signs of malicious uploads, admin-panel abuse, and tampering with application files.
Jul 24, 2026
OpenReplay fixed a critical stored cross-site scripting flaw, tracked as **`CVE-2026-55879`**, that affects versions **`1.24.0` before `1.25.0`** and can let an unauthenticated attacker take over dashboard accounts. The issue allows anyone with a public project key to submit malicious custom event names or page URLs that are stored by the platform and later rendered in the authenticated dashboard, where attacker-controlled JavaScript can execute in the dashboard origin, steal the session JWT from `localStorage`, and hijack user access. The vulnerability is rated **CVSS 9.3** and mapped to **`CWE-79`**. The remediation shipped in **OpenReplay `v1.25.0`** and was reflected in subsequent code changes that centralized output encoding for event read paths. The patch escapes event entries and nested property maps on the backend before returning data from `SearchEvents` and `GetEventByID`, and also hardens the frontend by escaping JSON shown in `EventDetailsModal`, replacing `innerHTML` with `textContent` in a text measurement helper, and adding a reusable HTML-escaping utility. Together, the changes indicate the flaw stemmed from unsanitized event content being inserted into the UI without proper output encoding.
Jul 11, 2026