OPeNDAP Hyrax Docker is vulnerable because its redirect handling does not validate URLs against the AllowedHosts allowlist. An attacker that can control the redirect URL can cause the server to resolve the target and issue a request to any internal or external host. The application also forwards Earthdata headers that carry authentication information—User-Id and Echo-Token—to the target, leaking valid credentials. This flaw is identified as CWE-918 (Server‑Side Request Forgery) and CWE-201 (Improper Access Control).

OPeNDAP Inc.’s Hyrax Docker product is affected. No specific version is listed in the CNA data, so any deployment of Hyrax Docker that has not applied a patch or the recommended mitigations remains vulnerable.

It is inferred that the attack vector is via any user able to send an HTTP request to the public redirect endpoint, as the feature is exposed publicly; any user can trigger it, so no special privileges are needed. The CVSS score of 6.5 indicates medium severity, the EPSS is below 1%, and the vulnerability is not in the CISA KEV catalog, suggesting limited known exploitation. Nonetheless, the ability to forward authentication headers to an attacker-controlled endpoint poses a significant confidentiality risk. Until mitigations are applied the risk persists, especially if internal network resources or privileged credentials are available behind the proxy.