CVE-2026-49996

LowCVSS 3.7/10Last modified Oct 18, 2026

Description

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2026
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-499975.4SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in CVE-2026-499988.2Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse CVE-2026-50007.3A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHandCVE-2026-500005.0SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communiCVE-2026-500039.8A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output direCVE-2026-500057.7Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.CVE-2026-500069.1Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatibCVE-2026-500077.2Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access CVE-2026-500086.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before versionCVE-2026-500094.8Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes CVE-2026-50017.3A flaw has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The affected element is the function do_POSTCVE-2026-500107.5Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,