CVE-2026-49996: SecureDrop Client Vulnerability Allows Cross-Origin Redirects

CVE-2026-49996: SecureDrop Client Vulnerability Allows Cross-Origin Redirects

First seen 22 Aug 2026, 14:48 UTC •Feedlyexploit-intel.comnvd.nist.goveuvd.enisa.europa.euvuldb.com+1 •91% similarity •30.9

Article Content

Browse articles
ThreatCluster

A vulnerability identified as CVE-2026-49996 affects the SecureDrop Client, a desktop application used by journalists for secure communication. Prior to version 1.3.1, a malicious SecureDrop Server could exploit this flaw to bypass the securedrop-proxy's origin limitation through cross-origin redirects. This vulnerability impacts SecureDrop installations that have not been updated to the latest version. The CVSS base score for this vulnerability is 3.7, indicating a low severity. Affected systems include SecureDrop Workstations that communicate with dedicated SecureDrop Servers. The issue has been addressed in version 1.3.1, which is now available for users to mitigate the risk. The vulnerability was published on August 20, 2026.

Key Points: • CVE-2026-49996 allows cross-origin redirects in SecureDrop Client versions prior to 1.3.1. • The vulnerability has a CVSS score of 3.7, categorized as low severity. • Version 1.3.1 of SecureDrop Client fixes the identified vulnerability.

ThreatCluster AI How this analysis works

Timeline

2026-08-20
CVE-2026-49996 published
The vulnerability affecting SecureDrop Client was officially published, detailing the cross-origin redirect issue.
nvd.nist.gov
2026-08-22
CVE-2026-49996 reported by multiple sources
Various cybersecurity outlets reported on the CVE, emphasizing the need for updates to version 1.3.1 to mitigate risks.
Feedly
2026-08-22
Version 1.3.1 released
The SecureDrop Client version 1.3.1 was released, addressing the cross-origin redirect vulnerability.
exploit-intel.com

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

SecureDrop Client SecureDrop Server SecureDrop Workstation Tor Tor Hidden Services