https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T06:40:37.329755+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-54442 fkie_cve-2026-54442 2026-11-11T06:40:37.333614+00:00

Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

 https://db.gcve.eu/vuln/ghsa-c6q7-wqw2-h65w GHSA-c6q7-wqw2-h65w — NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 2026-11-11T06:40:37.333956+00:00

Affected: Maven: gov.nsa.emissary:emissary

### Summary

The URL validation regex `^(https?:/)?/.*` added to emissary's `NavAction.java` allows protocol-relative URLs (`//evil.com/...`) and single-slash scheme variants (`http:/evil.com`) to bypass validation, enabling SSRF and open redirect attacks.

### Affected Package

- **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** < e2078417464b - **Patched versions:** >= e2078417464b

### Severity

Medium

### CWE

CWE-918 — Server-Side Request Forgery (SSRF)

### Details

The fix in `NavAction.java` (line 47) introduces a `VALID_LINK` pattern:

```java Pattern.compile("^(https?:/)?/.*") ```

This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors.

Protocol-relative URLs (`//evil.com/...`): The group `(https?:/)?` is optional, so the pattern reduces to `//.*` when the group is absent. This matches `//evil.com/steal?c=SESSION`, which browsers resolve to the current page's protocol plus the attacker's host.

Single-slash scheme (`http:/evil.com`): The regex group captures `http:/` as a valid match, and browsers normalize `http:/evil.com` to `http://evil.com`, creating an open redirect to the attacker's server.

Protocol-relative to cloud metadata (`//169.254.169.254/...`): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved.

The pre-fix code had no validation at…