CVE-2026-54442

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54442", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T15:30:40.317Z", "datePublished": "2026-11-05T20:30:51.486Z", "dateUpdated": "2026-11-05T21:03:16.917Z"}, "containers": {"cna": {"title": "NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"}, {"name": "https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6", "tags": ["x_refsource_MISC"], "url": "https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6"}, {"name": "https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0"}], "affected": [{"vendor": "NationalSecurityAgency", "product": "emissary", "versions": [{"version": "< 8.51.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:30:51.486Z"}, "descriptions": [{"lang": "en", "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0."}], "source": {"advisory": "GHSA-c6q7-wqw2-h65w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:02:51.528575Z", "id": "CVE-2026-54442", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:03:16.917Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54442", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:02:51.528575Z"}}}], "references": [{"url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:03:06.548Z"}}], "cna": {"title": "NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF", "source": {"advisory": "GHSA-c6q7-wqw2-h65w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "NationalSecurityAgency", "product": "emissary", "versions": [{"status": "affected", "version": "< 8.51.0"}]}], "references": [{"url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w", "name": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6", "name": "https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0", "name": "https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:30:51.486Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54442", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:03:16.917Z", "dateReserved": "2026-06-15T15:30:40.317Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T20:30:51.486Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "emissary", "vendor": "NationalSecurityAgency", "versions": [{"status": "affected", "version": "< 8.51.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0."}], "id": "CVE-2026-54442", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54442", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:02:51.528575Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:51.240", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6"}, {"source": "security-advisories@github.com", "url": "https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "gov.nsa.emissary/emissary: Emissary: Open redirect via improper navigation link URL validation", "id": "2567676", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567676"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-601", "details": ["A flaw was found in Emissary. The application fails to properly validate navigation links, accepting protocol-relative and malformed web addresses. An attacker with privileges to configure navigation links can exploit this flaw to redirect users to arbitrary external websites (an open redirect) or potentially trigger Server-Side Request Forgery (SSRF)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-54442", "public_date": "2026-11-05T20:30:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54442\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54442\nhttps://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6\nhttps://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0\nhttps://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires high administrative privileges to configure navigation endpoints and necessitates user interaction to execute. Red Hat products do not ship or support Emissary, resulting in no direct impact on supported Red Hat environments. Where standalone instances are deployed, the blast radius is constrained by the prerequisite administrative permissions and user interaction needed to trigger redirection.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.51.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "emissary", "source": "cna", "vendor": "NationalSecurityAgency"}, "product": "emissary", "vendor": "nationalsecurityagency"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.51.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "emissary", "source": "cna", "vendor": "NationalSecurityAgency"}, "product": "emissary", "vendor": "nsa"}], "created": "2026-11-05T21:45:04.826741+00:00", "updated": "2026-11-06T14:30:06.073837+00:00", "vendors": ["nationalsecurityagency", "nationalsecurityagency$PRODUCT$emissary", "nsa", "nsa$PRODUCT$emissary"], "weaknesses": ["CWE-601", "CWE-918"]}