TI-2026-32833 Aliases CVE-2026-44971 GHSA-587r-mc96-6f2p

GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

HIGH 75CWE-918Published 2026-05-27 · Updated 2026-05-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the GH_TOKEN used by GuardDog. This vulnerability is fixed in .

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0024 15th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
DataDog	guarddog	1.0.0 – 2.9.0	—	No fix listed	CNA
—	guarddog (PyPI)	1.0.0 – 2.9.0	—	No fix listed	GHSA-587r-mc96-6f2p

guarddog VendorDataDog Affected 1.0.0 – 2.9.0 Fixed in — No fix listed CNA
guarddog (PyPI) Vendor— Affected 1.0.0 – 2.9.0 Fixed in — No fix listed GHSA-587r-mc96-6f2p

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:datadoghq:guarddog::::::::	—	—	Datadoghq

cpe:2.3:a:datadoghq:guarddog:*:*:*:*:*:*:*:* Versions — — ·Datadoghq

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-44971
2026-10-03 Alias added: GHSA-587r-mc96-6f2p

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44971

Other 2

TI-2022-07587 GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package CVSS 3.1MEDIUM 6.5
TI-2026-26107 dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution CVSS 4.0CRITICAL 9.3
TI-2026-81528 ReDoS in dd-trace URL query string obfuscation CVSS 4.0HIGH 8.7
TI-2026-80927 ReDoS in Datadog dd-trace-py URL query string obfuscation CVSS 4.0HIGH 8.7
TI-2023-20052 import-in-the-middle allows unsanitized user controlled input in module generation CVSS 3.1CRITICAL 9.8
TI-2026-80928 Datadog dd-trace-py IAST flaw lets attackers crash Python processes CVSS 4.0HIGH 8.2

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences