MEDIUM 4.8 GitHub
CVE-2026-54442
NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571
### Summary
The URL validation regex `^(https?:/)?/.*` added to emissary's `NavAction.java` allows protocol-relative URLs (`//evil.com/...`) and single-slash scheme variants (`http:/evil.com`) to bypass validation, enabling SSRF and open redirect attacks.
### Affected Package
- **Ecosystem:** Maven
- **Package:** NationalSecurityAgency/emissary
- **Affected versions:** < e2078417464b
- **Patched versions:** >= e2078417464b
### Severity
Medium
### CWE
CWE-918 — Server-Side Request Forgery
Affected Products
- maven/gov.nsa.emissary:emissary < 8.51.0
References
- https://github.com/advisories/GHSA-c6q7-wqw2-h65w
- https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w
- https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp
- https://github.com/NationalSecurityAgency/emissary/commit/e2078417464b9004620dde28dcbca2f7
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-10-30 via GitHub. Affected: maven/gov.nsa.emissary:emissary < 8.51.0.
vulnfeed aggregates 17713 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.