Is CVE-2026-49826 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49826 being exploited in the wild.

How severe is CVE-2026-49826?

Medium severity, with a CVSS score of 4, published 1 July 2026.

Which products and versions are affected?

Concourse CI < 8.2.3; github.com/concourse/concourse (Go) < 1.6.1-0.20260526150512-ac60be5f0435, SEMVER:introduced=0,fixed=1.6.1-0.20260526150512-ac60be5f0435.

Is there a fix for CVE-2026-49826?

Yes. github.com/concourse/concourse (Go): upgrade to 1.6.1-0.20260526150512-ac60be5f0435 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49826 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49826?

Check whether you run Concourse CI or github.com/concourse/concourse (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49826: Concourse CI open redirect in login flow

Q: Which products and versions are affected?

Concourse CI < 8.2.3; github.com/concourse/concourse (Go) < 1.6.1-0.20260526150512-ac60be5f0435, SEMVER:introduced=0,fixed=1.6.1-0.20260526150512-ac60be5f0435.

Q: Is there a fix for CVE-2026-49826?

Yes. github.com/concourse/concourse (Go): upgrade to 1.6.1-0.20260526150512-ac60be5f0435 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49826 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-49826?

Check whether you run Concourse CI or github.com/concourse/concourse (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49826 · Severity: medium · CVSS 4 · Published 2026-07-01

Concourse CI, an open-source continuous integration tool, is vulnerable to an open redirect issue during its login process. An attacker can trick users into clicking a specially crafted link that, after a successful login, redirects them to a malicious external website. This technique is commonly used in phishing campaigns to deceive users into providing credentials to a fraudulent site that mimics the legitimate service.

Technologies: github.com/concourse/concourse (Go). Vendors: Go.

Quick answers

Is CVE-2026-49826 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49826 being exploited in the wild.
How severe is CVE-2026-49826?: Medium severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?: Concourse CI < 8.2.3; github.com/concourse/concourse (Go) < 1.6.1-0.20260526150512-ac60be5f0435, SEMVER:introduced=0,fixed=1.6.1-0.20260526150512-ac60be5f0435.
Is there a fix for CVE-2026-49826?: Yes. github.com/concourse/concourse (Go): upgrade to 1.6.1-0.20260526150512-ac60be5f0435 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49826 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49826?: Check whether you run Concourse CI or github.com/concourse/concourse (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/concourse/concourse (Go): upgrade to 1.6.1-0.20260526150512-ac60be5f0435 or later
```
go get github.com/concourse/concourse@v1.6.1-0.20260526150512-ac60be5f0435
```

Technical details

An open redirect vulnerability exists in Concourse CI's login flow due to improper handling of the 'redirect_uri' parameter. The root cause is related to how Go's 'url' package processes encoded characters; specifically, double-encoding or including backslashes can bypass path validation logic, causing a relative path like '/%2Fexample.com' to be interpreted as an absolute URL '//example.com'. An unauthenticated attacker can craft a URL that redirects a user to an arbitrary external site after they complete the login process. This issue is fixed in Concourse version 8.2.3.

Affected products

Concourse Concourse CI < 8.2.3

Identifiers

CVE-2026-49826
GHSA-8w27-c4vc-88q9
GO-2026-5866

Timeline

2026-05-27: disclosed
2026-07-01: advisory: GitHub Advisory published
2026-07-01: patched: Fix confirmed in version 8.2.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.