CVE-2026-49996
Received Received - Intake

Origin Bypass in SecureDrop Client via Cross-Origin Redirects

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-49996
EUVD
EUVD-2026-63576

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
freedomofpress securedrop_client 1.3.1
freedomofpress securedrop_server *
securedrop client 1.3.1
securedrop server to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SecureDrop Client allows a malicious SecureDrop Server to bypass origin restrictions by using cross-origin redirects. The securedrop-proxy component was configured to follow redirects by default, letting the server redirect requests to unintended destinations. Version 1.3.1 fixes this by disabling redirect following.

Detection Guidance

To detect this vulnerability, check if your SecureDrop Client version is below 1.3.1. Run: securedrop-client --version. If the version is older, the system is vulnerable. Inspect network traffic for unexpected cross-origin redirects between the client and server.

Impact Analysis

The impact is limited due to high attack complexity. A compromised SecureDrop Server could redirect requests to unintended origins, potentially exposing limited confidential data. However, exploitation is difficult in practice and no wild exploitation has been observed.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it requires a previously compromised SecureDrop Server and has limited impact on confidentiality. The attack complexity is high, and no exploitation in the wild has been observed.

Mitigation Strategies

Upgrade SecureDrop Client to version 1.3.1 or later. Update the proxy configuration to disable redirect following. Verify the changes by testing that redirects are no longer processed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart