Read the docs
TI-2026-85658 Aliases CVE-2026-54442

Emissary link validation bypass allows server-side request forgery

Priority LOW 22CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Emissary before 8.51.0 and the Maven package gov.nsa.emissary:emissary from 0 before 8.51.0 are affected. The VALID_LINK validation in NavAction accepts protocol-relative URLs in configured navigation links, and browsers can interpret these as external origins, which is classified as CWE-918. A remote attacker with high privileges who gets a user to interact can cause open redirect, server-side request forgery and cloud metadata access, according to the advisory.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

Why it matters now

EPSS 0.00352 29th percentileScored 2026-11-07
Fix Fixed emissary (NationalSecurityAgency): 8.51.0gov.nsa.emissary:emissary (Maven): 8.51.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NationalSecurityAgencyemissarybefore 8.51.08.51.0Patch availableCNA
—gov.nsa.emissary:emissary (Maven)before 8.51.08.51.0Patch availableGHSA-c6q7-wqw2-h65w
  • emissary VendorNationalSecurityAgency Affected before 8.51.0 Fixed in 8.51.0 Patch available CNA
  • gov.nsa.emissary:emissary (Maven) Vendor— Affected before 8.51.0 Fixed in 8.51.0 Patch available GHSA-c6q7-wqw2-h65w

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*——NationalSecurityAgency

Remediation

Update Emissary to version 8.51.0, which fixes the emissary product and the Maven package gov.nsa.emissary:emissary.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA emissary (NationalSecurityAgency) Fixed in 8.51.0
  • Fix · GHSA-c6q7-wqw2-h65w gov.nsa.emissary:emissary (Maven) Fixed in 8.51.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-54442
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat

References

Other 7

  • TI-2026-39515 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover CVSS 3.1CRITICAL 9.6
  • TI-2023-08846 Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes… CVSS 3.1CRITICAL 9.8
  • TI-2026-37876 Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search CVSS 4.0HIGH 8.7
  • TI-2026-27685 Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix CVSS 3.1HIGH 8.8
  • TI-2026-04310 NSA Ghidra Auto-Analysis Annotation Command Execution CVSS 3.1HIGH 8.8
  • TI-2026-37873 Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import CVSS 4.0HIGH 8.4
See all 53 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences