exploit-intel.com CVE-2026-49996: SecureDrop Client Vulnerability Allows Cross-Origin Redirects
Article Content
- •CVE-2026-49996 allows cross-origin redirects in SecureDrop Client versions prior to 1.3.1.
- •The vulnerability has a CVSS score of 3.7, categorized as low severity.
- •Version 1.3.1 of SecureDrop Client fixes the identified vulnerability.
A vulnerability identified as CVE-2026-49996 affects the SecureDrop Client, a desktop application used by journalists for secure communication. Prior to version 1.3.1, a malicious SecureDrop Server could exploit this flaw to bypass the securedrop-proxy's origin limitation through cross-origin redirects. This vulnerability impacts SecureDrop installations that have not been updated to the latest version. The CVSS base score for this vulnerability is 3.7, indicating a low severity. Affected systems include SecureDrop Workstations that communicate with dedicated SecureDrop Servers. The issue has been addressed in version 1.3.1, which is now available for users to mitigate the risk. The vulnerability was published on August 20, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track CVE-2026-49996 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to… 
Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…