ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-54442

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

Published Oct 30, 2026 · catalog updated Nov 4, 2026 · NationalSecurityAgency/emissary has an incomplete

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-54442. A missing EPSS score is not a low risk. Compare NationalSecurityAgency/emissary has an incomplete with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (NationalSecurityAgency/emissary has an incomplete).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Medium4.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Not in the current FIRST EPSS dataset
Remediation
Advisory link
Affected products
Maven gov.nsa.emissary:emissary

### Summary The URL validation regex added to emissary's allows protocol-relative URLs ( ) and single-slash scheme variants ( ) to bypass validation, enabling SSRF and open redirect attacks. ### Affected Package - **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** = e2078417464b ### Severity Medium ### CWE CWE-918 — Server-Side Request Forgery (SSRF) ### Details The fix in (line 47) introduces a pattern: This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors. Protocol-relative URLs ( ): The group is optional, so the pattern reduces to when the group is absent. This matches , which browsers resolve to the current page's protocol plus the attacker's host. Single-slash scheme ( ): The regex group captures as a valid match, and browsers normalize to , creating an open redirect to the attacker's server. Protocol-relative to cloud metadata ( ): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved. The pre-fix code had no validation at all, accepting any URL. The fix blocks , , and URIs, but the protocol-relative and single-slash bypasses remain exploitable. ### PoC **Steps to reproduce:** 1. Run 2. Observe that protocol-relative and single-slash URLs bypass the regex **Expected output:** ### Impact An attacker can craft navigation links that bypass URL validation to redirect users to attacker-controlled servers (open redirect) or make the emissary server issue requests to internal services (SSRF). The bypass is particularly dangerous in cloud environments, enabling retrieval of IAM credentials. ### Suggested Remediation Replace the regex with one that explicitly rejects protocol-relative URLs. Alternatively, parse the URL with and validate the scheme and host against an allowlist rather than relying on regex. ### References - Incomplete fix commit: https://git

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Maven gov.nsa.emissary:emissary0 → 8.51.0

How to fix CVE-2026-54442

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-54442. A missing EPSS score is not a low risk. Compare NationalSecurityAgency/emissary has an incomplete with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 8.51.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-918: Server-Side Request Forgery (SSRF). EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Summary The URL validation regex added to emissary's allows protocol-relative URLs ( ) and single-slash scheme variants ( ) to bypass validation, enabling SSRF and open redirect attacks. ### Affected Package - **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** = e2078417464b ### Severity Medium ### CWE CWE-918 — Server-Side Request Forgery (SSRF) ### D

  2. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    gov.nsa.emissary:emissary fixed in 8.51.0

  3. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    gov.nsa.emissary:emissary fixed in 8.51.0

  4. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Summary The URL validation regex added to emissary's allows protocol-relative URLs ( ) and single-slash scheme variants ( ) to bypass validation, enabling SSRF and open redirect attacks. ### Affected Package - **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** = e2078417464b ### Severity Medium ### CWE CWE-918 — Server-Side Request Forgery (SSRF) ### D

  5. Nov 4, 2026 · GitHub Advisory Database

    Updated

    ### Summary The URL validation regex added to emissary's allows protocol-relative URLs ( ) and single-slash scheme variants ( ) to bypass validation, enabling SSRF and open redirect attacks. ### Affected Package - **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** = e2078417464b ### Severity Medium ### CWE CWE-918 — Server-Side Request Forgery (SSRF) ### D

Sources

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseNov 5, 2026
  • OpenSSF OSV / OSV ScannerNov 5, 2026
  • CVE.orgOct 31, 2026