{"affected":[{"product":"emissary","source":"CNA: GitHub_M","vendor":"NationalSecurityAgency","versions":[{"status":"affected","version":"< 8.51.0"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"gov.nsa.emissary:emissary","product":"gov.nsa.emissary:emissary","source":"OSV GHSA-c6q7-wqw2-h65w","vendor":"","versions":[{"status":"affected","version":"8.0.0","versionType":"Maven"},{"status":"affected","version":"8.1.0","versionType":"Maven"},{"status":"affected","version":"8.10.0","versionType":"Maven"},{"status":"affected","version":"8.11.0","versionType":"Maven"},{"status":"affected","version":"8.11.1","versionType":"Maven"},{"status":"affected","version":"8.12.0","versionType":"Maven"},{"status":"affected","version":"8.13.0","versionType":"Maven"},{"status":"affected","version":"8.14.0","versionType":"Maven"},{"status":"affected","version":"8.15.0","versionType":"Maven"},{"status":"affected","version":"8.16.0","versionType":"Maven"},{"status":"affected","version":"8.17.0","versionType":"Maven"},{"status":"affected","version":"8.18.0","versionType":"Maven"},{"status":"affected","version":"8.19.0","versionType":"Maven"},{"status":"affected","version":"8.19.1","versionType":"Maven"},{"status":"affected","version":"8.2.0","versionType":"Maven"},{"status":"affected","version":"8.20.0","versionType":"Maven"},{"status":"affected","version":"8.21.0","versionType":"Maven"},{"status":"affected","version":"8.22.0","versionType":"Maven"},{"status":"affected","version":"8.23.0","versionType":"Maven"},{"status":"affected","version":"8.24.0","versionType":"Maven"},{"status":"affected","version":"8.25.0","versionType":"Maven"},{"status":"affected","version":"8.26.0","versionType":"Maven"},{"status":"affected","version":"8.27.0","versionType":"Maven"},{"status":"affected","version":"8.28.0","versionType":"Maven"},{"status":"affected","version":"8.29.0","versionType":"Maven"},{"status":"affected","version":"8.3.0","versionType":"Maven"},{"status":"affected","version":"8.30.0","versionType":"Maven"},{"status":"affected","version":"8.31.0","versionType":"Maven"},{"status":"affected","version":"8.32.0","versionType":"Maven"},{"status":"affected","version":"8.33.0","versionType":"Maven"},{"status":"affected","version":"8.34.0","versionType":"Maven"},{"status":"affected","version":"8.35.0","versionType":"Maven"},{"status":"affected","version":"8.36.0","versionType":"Maven"},{"status":"affected","version":"8.37.0","versionType":"Maven"},{"status":"affected","version":"8.38.0","versionType":"Maven"},{"status":"affected","version":"8.39.0","versionType":"Maven"},{"status":"affected","version":"8.4.0","versionType":"Maven"},{"status":"affected","version":"8.40.0","versionType":"Maven"},{"status":"affected","version":"8.41.0","versionType":"Maven"},{"status":"affected","version":"8.42.0","versionType":"Maven"},{"status":"affected","version":"8.43.0","versionType":"Maven"},{"status":"affected","version":"8.44.0","versionType":"Maven"},{"status":"affected","version":"8.45.0","versionType":"Maven"},{"status":"affected","version":"8.46.0","versionType":"Maven"},{"status":"affected","version":"8.47.0","versionType":"Maven"},{"status":"affected","version":"8.48.0","versionType":"Maven"},{"status":"affected","version":"8.49.0","versionType":"Maven"},{"status":"affected","version":"8.5.0","versionType":"Maven"},{"status":"affected","version":"8.50.0","versionType":"Maven"},{"status":"affected","version":"8.6.0","versionType":"Maven"},{"status":"affected","version":"8.7.0","versionType":"Maven"},{"status":"affected","version":"8.7.1","versionType":"Maven"},{"status":"affected","version":"8.8.0","versionType":"Maven"},{"status":"affected","version":"8.9.0","versionType":"Maven"},{"events":[{"introduced":"0"},{"fixed":"8.51.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-54442","cwes":["CWE-918"],"description":"Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"}],"kev":null,"metrics":[{"score":4.8,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793912596917,"publishedAt":1793910651486,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-c6q7-wqw2-h65w"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-c6q7-wqw2-h65w"}],"remediation":[{"kind":"fix","source":"OSV GHSA-c6q7-wqw2-h65w","text":"gov.nsa.emissary:emissary (Maven): OSV reports a fixed version 8.51.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-c6q7-wqw2-h65w"}],"revision":"777cf79904bb537c0d936415f3e50ce5ae8f6a3bf9ee1894e41b27236557e359","sources":[{"modifiedAt":1793912596917,"name":"CNA: GitHub_M","retrievedAt":1793913846355,"url":"https://www.cve.org/CVERecord?id=CVE-2026-54442"},{"modifiedAt":1793831404054,"name":"OSV / GitHub Security Advisories","retrievedAt":1793913847105,"url":"https://osv.dev/vulnerability/GHSA-c6q7-wqw2-h65w"}],"ssvc":{"assessedAt":1793912571528,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF","updatedAt":1793913847105}