Read the docs
TI-2026-36827 Aliases CVE-2026-49996

securedrop-proxy origin limitation can be bypassed with redirects

Priority LOW 17CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00309 23rd percentileScored 2026-11-07
Fix Fixed securedrop-client (freedomofpress): 1.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
freedomofpresssecuredrop-clientbefore 1.3.11.3.1Patch availableCNA
  • securedrop-client Vendorfreedomofpress Affected before 1.3.1 Fixed in 1.3.1 Patch available CNA

Remediation

  • Fix · CNA securedrop-client (freedomofpress) Fixed in 1.3.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49996

References

Other 2

  • TI-2025-18590 Path traversal in SecureDrop Client API.download_reply() CVSS 3.1HIGH 8.1
  • TI-2026-83225 SecureDrop lets API session tokens be reused against the web UI CVSS 3.1MEDIUM 5.0
  • TI-2025-18591 Path traversal in sd-log Qubes virtual machine CVSS 3.1MEDIUM 4.5
  • TI-2026-86124 SecureDrop copies Onion Service credentials to Monitor Server CVSS 3.1LOW 2.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences