← CVE Radar
CVE-2026-54442NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF
Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.
4.8 MEDIUMEPSS 0.35%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 4.8 | MEDIUM | 3.1GitHub_M (CNA) | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Details
- CVE ID
- CVE-2026-54442
- Status
- Received
- Assigner (CNA)
- GitHub_M
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 21:18 UTC
- Weaknesses
- CWE-918 · Server-Side Request Forgery (SSRF)
Affected Products
As published by the CNA in the CVE record.
NationalSecurityAgencyemissary1 version range
- < 8.51.0