Executive brief
Odysseus is a self-hosted AI chat and search application that processes user data through an embedding backend. A critical vulnerability allows any authenticated user—including those without administrator privileges—to redirect all user data (chat messages, search queries, memory, vault content) to an attacker-controlled server in plaintext, or disable the embedding service entirely for all users.
Technical details
The vulnerability is a missing authorization check in the POST /api/embeddings/endpoint route in routes/embedding_routes.py. The endpoint enforces session authentication but omits the admin authorization guard (require_admin) that is present on all other privileged routes in the codebase. An authenticated non-admin user can supply an attacker-controlled URL to overwrite the server-wide embedding backend configuration, which is persisted to disk and environment variables. The same endpoint also exhibits SSRF by accepting and probing arbitrary URLs without validation (no scheme allowlist, no rejection of private/loopback/cloud-metadata IPs). When users submit embedding requests (chat, RAG, memory), all plaintext data is transmitted to the attacker's URL. The fix (commit bf325f6) adds the missing require_admin() check to all embedding route handlers.
Affected products
- Odysseus Odysseus before commit bf325f6
Timeline
- 2026-06-16: disclosed: Public vulnerability disclosure on GitHub issue #132
- 2026-06-16: patched: Patch applied in commit bf325f6
- 2026-08-04: advisory: CVE-2026-70619 published on NVD