CVE-2026-49996

CVE

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

August 22, 2026

Last Seen

August 22, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

CVE-2026-49996: SecureDrop Client Vulnerability Allows Cross-Origin Redirects30.9

A vulnerability identified as CVE-2026-49996 affects the SecureDrop Client, a desktop application used by journalists for secure communication. Prior to version 1.3.1, a malicious SecureDrop Server could exploit this flaw to bypass the securedrop-proxy's origin limitation through cross-origin redire...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

CVE-2026-49996: SecureDrop Client Vulnerability Allows Cross-Origin Redirects

Aug 22·1 sources

Related Articles (3)

CVE-2026-49996 National Vulnerability Database / 1d SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services fo

nvd.nist.gov·Aug 22

CVE-2026-49996: securedrop-proxy origin limitation can be bypassed with redirects [LOW] CVSS 3.7 Exploit Intelligence - Recent CVEs / 1d SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is

exploit-intel.com·Aug 22

CVE-2026-49996 - Exploits & Severity

Related Entities

Zero-day Exploit SecureDrop Workstation SecureDrop Client SecureDrop Server Tor Tor Hidden Services SSH