Description
A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-31
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server-side request forgery (SSRF)
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in the scaleImage function within the NASA Earthdata-Search 1.0.0 component. The flaw allows an unauthenticated attacker to craft a request that causes the server to perform arbitrary HTTP requests, exposing the service to server‑side request forgery. This can enable the attacker to access internal resources, exfiltrate data, or use the system as a proxy for further attacks.

Affected Systems

NASA Earthdata‑Search version 1.0.0 is affected. The vulnerability resides in the scale Endpoint handler located at serverless/src/scaleImage/handler.js.

Risk and Exploitability

With a CVSS score of 6.9, the exploit is considered moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The attack can be initiated remotely without authentication, making it easily exploitable. Since the exploit is publicly disclosed, the likelihood of use is non‑negligible.

Generated by OpenCVE AI on August 31, 2026 at 16:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any official patch or newer version of NASA Earthdata‑Search once released.
  • Restrict the network access of the scaleImage service so it cannot reach arbitrary external hosts, using firewall rules or a proxy.
  • Add input validation to the scale endpoint to allow requests only to whitelisted domains and reject others, mitigating SSRF risk.

Generated by OpenCVE AI on August 31, 2026 at 16:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery
First Time appeared Nasa
Nasa earthdata-search
Weaknesses CWE-918
CPEs cpe:2.3:a:nasa:earthdata-search:*:*:*:*:*:*:*:*
Vendors & Products Nasa
Nasa earthdata-search
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nasa Earthdata-search
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T17:56:25.791Z

Reserved: 2026-08-31T04:21:35.438Z

Link: CVE-2026-82801

cve-icon Vulnrichment

Updated: 2026-08-31T17:55:42.993Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T15:18:19.680

Modified: 2026-09-01T20:48:22.513

Link: CVE-2026-82801

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:21:13Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)