Executive brief
Odysseus is a self-hosted AI chat, RAG, and memory application that allows users to store and search conversations. The embedding endpoint configuration accepts URLs without validation, allowing any authenticated user to redirect the server to probe internal networks and cloud metadata services, exposing sensitive data and enabling lateral movement within the infrastructure.
Technical details
Odysseus contains a server-side request forgery (SSRF) vulnerability in the POST /api/embeddings/endpoint handler (routes/embedding_routes.py). The vulnerable code accepts a user-supplied URL parameter and immediately makes an outbound httpx.post request with no scheme allowlist, no private IP filtering, and no DNS rebind validation. The root cause is twofold: the endpoint enforces authentication only (any signed-in user can reach it, not just admins), and the URL is passed directly to the HTTP client without calling the existing validate_webhook_url helper. An attacker with a valid account can point the server-wide embedding endpoint at arbitrary hosts, including loopback addresses (127.0.0.1), RFC 1918 private ranges, link-local addresses, and cloud metadata services (169.254.169.254). The hijack persists to data/embedding_endpoint.json and the EMBEDDING_URL environment variable, surviving server restarts. All user embeddings then flow to the attacker's URL in plaintext. The vulnerability was fixed in commit 87babb5 with URL validation logic in src/url_safety.py that blocks non-HTTP(S) schemes and metadata-service ranges while allowing local LAN addresses by default.
Affected products
- Odysseus Odysseus before commit 87babb5
Timeline
- 2026-06-16: disclosed: Security researcher Yunus Aydın published detailed writeup on vulnerability
- 2026-06-02: patched: Fix committed as 87babb5 with SSRF hardening and URL validation