CVE-2026-54442

Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

• CWE-918

• https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6
• https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0
• https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w
• https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5443A heap buffer overflow vulnerability exists during the decod…9.8
• CVE-2026-54430liboauth2 is vulnerable to Server-Side Request Forgery in oa…5.1
• CVE-2026-54431In liboauth2 the Demonstrating Proof-of-Possession (DPoP) ve…5.1
• CVE-2026-54432Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allow…4.7
• CVE-2026-54433In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, t…10
• CVE-2026-5444A heap buffer overflow vulnerability exists in the PAM image…7.1
• CVE-2026-54443Dashy is a self-hostable personal dashboard. From 1.9.4 unti…5.9
• CVE-2026-54444Rejected reason: ]** REJECT ** DO NOT USE THIS CANDIDATE NUM…
• CVE-2026-54445vantage6 is an open-source infrastructure for privacy preser…6.9
• CVE-2026-54446NetLicensing MCP Server is a natural-language interface that…8.1
• CVE-2026-54447garminconnect is a Python 3 API wrapper for Garmin Connect t…8.4
• CVE-2026-54448Trivy is a security scanner. Prior to 0.71.0, when Trivy sca…6.5