# CVE-2026-82802: NASA Earthdata Search server-side request forgery in OpenSearch endpoint

Source: https://junglewise.ai/threats/cve-2026-82802-nasa-earthdata-search-server-side-request-forgery-in-opensearch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82802 · Severity: medium · CVSS 5.3 · Published 2026-08-31

NASA's Earthdata Search is a web-based tool for discovering and accessing satellite Earth observation data. A server-side request forgery (SSRF) vulnerability in the OpenSearch Granule endpoint allows unauthenticated remote attackers to manipulate the system into making arbitrary network requests, potentially leading to unauthorized access to internal services or sensitive data exposure.

Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa).

## Quick answers

**Is CVE-2026-82802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82802 being exploited in the wild.

**How severe is CVE-2026-82802?** Medium severity, with a CVSS score of 5.3, published 31 August 2026.

**Which products and versions are affected?** Nasa Earthdata Search 1.0.0.

**Is there a fix for CVE-2026-82802?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82802 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82802?** Check whether you run Nasa Earthdata Search at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) flaw in the OpenSearchGranuleSearchLambda function within serverless/src/openSearchGranuleSearch/handler.js. The vulnerability arises from insufficient validation of the openSearchOsdd parameter, which an attacker can manipulate to force the server to make requests to unintended internal or external systems. The attack is unauthenticated and remotely exploitable via network access to the endpoint. An attacker can leverage this to access internal resources, bypass firewall restrictions, or interact with backend services not intended for external access. A patch or update status is not confirmed in the advisory.

## Affected products

- NASA Earthdata Search 1.0.0

## Timeline

- 2026-08-31: disclosed
- other: Exploit published publicly

## References

- [https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Unauthenticated%20OpenSearch%20Granule%20SSRF](https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Unauthenticated%20OpenSearch%20Granule%20SSRF)
- [https://vuldb.com/cve/CVE-2026-82802](https://vuldb.com/cve/CVE-2026-82802)

## Related threats

- [NASA Earthdata Search server-side request forgery in scale endpoint](https://junglewise.ai/threats/cve-2026-82801-nasa-earthdata-search-server-side-request-forgery-in-scale)