URL Path Injection in Swoosh MsGraph Adapter

Executive Summary

CVE-2026-54893 is a vulnerability in the Swoosh Microsoft Graph adapter where the sender's email address is directly inserted into the Microsoft Graph API request URL path without proper percent-encoding or validation.

Because of this, attackers can inject URL-special characters such as /, ?, or # into the local part of the email address. This allows them to escape the intended URL path segment and manipulate the request path and query string.

Since the request is authenticated with the application's Microsoft Graph bearer token, attackers can redirect the request to other Graph API endpoints within the token's scopes, effectively controlling the request's destination and parameters.

This vulnerability affects Swoosh versions from 1.12.0 up to but not including 1.26.3, and only impacts applications that derive the sender address from untrusted or user-influenced input.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform constrained server-side request forgery (SSRF) by redirecting authenticated Microsoft Graph API requests to unintended endpoints within the token's scopes.

If your application uses untrusted input to set the sender's email address, an attacker could manipulate the request path and query string, potentially causing unauthorized actions or data exposure within the permissions granted by the token.

Applications that always use a fixed, trusted sender address are not affected by this issue.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the application uses the Swoosh Microsoft Graph adapter with versions from 1.12.0 up to but not including 1.26.3, and if it interpolates the sender's email address into the Microsoft Graph API request URL without proper percent-encoding or validation.

Specifically, you can monitor outgoing Microsoft Graph API requests to see if the URL path contains unencoded or suspicious characters such as /, ?, or # within the sender's email address segment.

Commands to detect this might include capturing and inspecting HTTP requests from the application, for example using network tools like tcpdump or Wireshark to filter POST requests to Microsoft Graph endpoints, then searching for unencoded special characters in the URL path.

• Use tcpdump to capture traffic on port 443 (HTTPS) and filter for POST requests to Microsoft Graph endpoints.
• Use a proxy tool like mitmproxy or Fiddler to intercept and inspect the outgoing HTTP requests from the application.
• Search logs or captured requests for URL paths containing unencoded special characters in the sender email portion, such as /, ?, or #.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include validating or rejecting sender email addresses that contain URL-special characters such as /, ?, or # before they are passed to the Swoosh Microsoft Graph adapter.

Alternatively, configure the adapter to use a static, fixed, and trusted sender address to avoid interpolation of untrusted input into the URL path.

Upgrading the Swoosh library to version 1.26.3 or later is recommended, as this version includes a fix that percent-encodes the sender email address before interpolation, neutralizing injection vectors.

Useful 0 Not Useful 0