What’s Vulnerable › Vulnerabilities

CVE-2026-49996: securedrop-proxy origin limitation can be bypassed with redirects

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-20 · updated 2026-10-18
• Weakness: CWE-601

Description

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.

Affected products

• freedomofpress securedrop-client: before 1.3.1

References

• https://github.com/freedomofpress/securedrop-client/commit/3c9769b12fb115768d43617635fd2e00737ef2f7
• https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-6qxc-pcfg-v6qv

Get alerted when CVE-2026-49996 or the next vulnerability affects your stack