CVE-2026-49996

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/freedomofpress/securedrop-client/commit/3c9769b12fb115768d43617635fd2e00737ef2f7
https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-6qxc-pcfg-v6qv

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El Cliente SecureDrop es una aplicación de escritorio para que los periodistas se comuniquen de forma segura con las fuentes y gestionen los envíos en la Workstation de SecureDrop. Antes de la versión 1.3.1, un Servidor SecureDrop malicioso podría eludir la limitación de origen de securedrop-proxy respondiendo con redirecciones de origen cruzado. El propio Servidor SecureDrop tiene múltiples capas de endurecimiento incorporado y es una máquina física dedicada expuesta en internet solo a través de servicios ocultos de Tor para las interfaces de Fuente y Periodista, y opcionalmente a través de acceso SSH remoto sobre otro servicio oculto de Tor. La Workstation de SecureDrop de una sala de prensa se comunica solo con su propio Servidor SecureDrop dedicado. La versión 1.3.1 soluciona el problema.

Information

Published : 2026-08-20 19:16

Updated : 2026-10-18 20:10

NVD link : CVE-2026-49996

Mitre link : CVE-2026-49996

CVE.ORG link : CVE-2026-49996

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-49996", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49996", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:48:49.078652Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "freedomofpress", "product": "securedrop-client", "versions": [{"status": "affected", "version": "< 1.3.1"}]}]}], "published": "2026-08-20T19:16:53.757", "references": [{"url": "https://github.com/freedomofpress/securedrop-client/commit/3c9769b12fb115768d43617635fd2e00737ef2f7", "source": "security-advisories@github.com"}, {"url": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-6qxc-pcfg-v6qv", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue."}, {"lang": "es", "value": "El Cliente SecureDrop es una aplicaci\u00f3n de escritorio para que los periodistas se comuniquen de forma segura con las fuentes y gestionen los env\u00edos en la Workstation de SecureDrop. Antes de la versi\u00f3n 1.3.1, un Servidor SecureDrop malicioso podr\u00eda eludir la limitaci\u00f3n de origen de securedrop-proxy respondiendo con redirecciones de origen cruzado. El propio Servidor SecureDrop tiene m\u00faltiples capas de endurecimiento incorporado y es una m\u00e1quina f\u00edsica dedicada expuesta en internet solo a trav\u00e9s de servicios ocultos de Tor para las interfaces de Fuente y Periodista, y opcionalmente a trav\u00e9s de acceso SSH remoto sobre otro servicio oculto de Tor. La Workstation de SecureDrop de una sala de prensa se comunica solo con su propio Servidor SecureDrop dedicado. La versi\u00f3n 1.3.1 soluciona el problema."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}