Is CVE-2026-54442 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54442 being exploited in the wild.

How severe is CVE-2026-54442?

Medium severity, with a CVSS score of 4.8, published 5 November 2026.

Which products and versions are affected?

gov.nsa.emissary:emissary (Maven) < 8.51.0, ECOSYSTEM:introduced=0,fixed=8.51.0; NationalSecurityAgency Emissary prior to commit e2078417464b.

How is CVE-2026-54442 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54442?

Check whether you run gov.nsa.emissary:emissary (Maven) or NationalSecurityAgency Emissary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54442: NationalSecurityAgency Emissary incomplete SSRF/redirect fix

Q: Is there a fix for CVE-2026-54442?

Yes. gov.nsa.emissary:emissary (Maven): upgrade to 8.51.0 or later. Until then: Avoid relying solely on regex for URL validation. Replace the pattern with explicit URL parsing using java.net.URI and validate the scheme and host against an allowlist to prevent protocol-relative and malformed-scheme bypasses. [{"kind":"disclosed","at":"2026-10-30","note":"GHSA-c6q7-wqw2-h65w published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-54442 · Severity: medium · CVSS 4.8 · Published 2026-11-05

Emissary is a data integration system used for processing and routing information. A URL validation regex meant to prevent attacks was designed with bypass flaws that allow protocol-relative URLs (//evil.com) and malformed schemes (http:/evil.com) to slip through, enabling attackers to redirect users or force the server to access internal systems, including cloud metadata endpoints where credentials may be stored.

Technologies: gov.nsa.emissary:emissary (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-54442 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54442 being exploited in the wild.
How severe is CVE-2026-54442?: Medium severity, with a CVSS score of 4.8, published 5 November 2026.
Which products and versions are affected?: gov.nsa.emissary:emissary (Maven) < 8.51.0, ECOSYSTEM:introduced=0,fixed=8.51.0; NationalSecurityAgency Emissary prior to commit e2078417464b.
Is there a fix for CVE-2026-54442?: Yes. gov.nsa.emissary:emissary (Maven): upgrade to 8.51.0 or later. Until then: Avoid relying solely on regex for URL validation. Replace the pattern with explicit URL parsing using java.net.URI and validate the scheme and host against an allowlist to prevent protocol-relative and malformed-scheme bypasses.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-30","note":"GHSA-c6q7-wqw2-h65w published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54442 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54442?: Check whether you run gov.nsa.emissary:emissary (Maven) or NationalSecurityAgency Emissary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gov.nsa.emissary:emissary (Maven): upgrade to 8.51.0 or later

# set gov.nsa.emissary:emissary to 8.51.0 in your pom.xml or build.gradle

Avoid relying solely on regex for URL validation. Replace the pattern with explicit URL parsing using java.net.URI and validate the scheme and host against an allowlist to prevent protocol-relative and malformed-scheme bypasses.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-30","note":"GHSA-c6q7-wqw2-h65w published"}]

Technical details

The NavAction.java validator uses the regex pattern `^(https?:/)?/.*` to restrict URLs to relative paths and HTTP(S) schemes, but the optional group allows the pattern to match protocol-relative URLs (//evil.com) and single-slash variants (http:/evil.com) due to how browsers normalize these forms. This enables SSRF and open redirect attacks, especially dangerous in cloud environments where protocol-relative requests to 169.254.169.254 can expose IAM credentials.

Affected products

NationalSecurityAgency Emissary prior to commit e2078417464b

Identifiers

CVE-2026-54442
GHSA-c6q7-wqw2-h65w

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.