# CVE-2026-54442: NationalSecurityAgency Emissary incomplete SSRF/redirect fix

Source: https://junglewise.ai/threats/cve-2026-54442-nationalsecurityagency-emissary-has-an-incomplete-fix-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-54442 · Severity: medium · CVSS 4.8 · Published 2026-11-05

Emissary is a data integration system used for processing and routing information. A URL validation regex meant to prevent attacks was designed with bypass flaws that allow protocol-relative URLs (//evil.com) and malformed schemes (http:/evil.com) to slip through, enabling attackers to redirect users or force the server to access internal systems, including cloud metadata endpoints where credentials may be stored.

Technologies: [gov.nsa.emissary:emissary (Maven)](https://junglewise.ai/threats/technologies/gov-nsa-emissary-emissary). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-54442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54442 being exploited in the wild.

**How severe is CVE-2026-54442?** Medium severity, with a CVSS score of 4.8, published 5 November 2026.

**Which products and versions are affected?** gov.nsa.emissary:emissary (Maven) < 8.51.0, ECOSYSTEM:introduced=0,fixed=8.51.0; NationalSecurityAgency Emissary prior to commit e2078417464b.

**Is there a fix for CVE-2026-54442?** Yes. gov.nsa.emissary:emissary (Maven): upgrade to 8.51.0 or later. Until then: Avoid relying solely on regex for URL validation. Replace the pattern with explicit URL parsing using java.net.URI and validate the scheme and host against an allowlist to prevent protocol-relative and malformed-scheme bypasses.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-30","note":"GHSA-c6q7-wqw2-h65w published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54442 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54442?** Check whether you run gov.nsa.emissary:emissary (Maven) or NationalSecurityAgency Emissary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- gov.nsa.emissary:emissary (Maven): upgrade to 8.51.0 or later

  ```sh
  # set gov.nsa.emissary:emissary to 8.51.0 in your pom.xml or build.gradle
  ```


Avoid relying solely on regex for URL validation. Replace the pattern with explicit URL parsing using java.net.URI and validate the scheme and host against an allowlist to prevent protocol-relative and malformed-scheme bypasses.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-30","note":"GHSA-c6q7-wqw2-h65w published"}]

## Technical details

The NavAction.java validator uses the regex pattern `^(https?:/)?/.*` to restrict URLs to relative paths and HTTP(S) schemes, but the optional group allows the pattern to match protocol-relative URLs (//evil.com) and single-slash variants (http:/evil.com) due to how browsers normalize these forms. This enables SSRF and open redirect attacks, especially dangerous in cloud environments where protocol-relative requests to 169.254.169.254 can expose IAM credentials.

## Affected products

- NationalSecurityAgency Emissary prior to commit e2078417464b

## Identifiers

- CVE-2026-54442
- GHSA-c6q7-wqw2-h65w

## Related threats

- [Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix](https://junglewise.ai/threats/cve-2026-35582-emissary-has-an-os-command-injection-via-unvalidated-in-file)
- [Emissary has a Path Traversal via Blacklist Bypass in Configuration API](https://junglewise.ai/threats/cve-2026-35583-emissary-has-a-path-traversal-via-blacklist-bypass-in)
- [Emissary has a Command Injection via PLACE_NAME Configuration in Executrix](https://junglewise.ai/threats/cve-2026-35581-emissary-has-a-command-injection-via-place-name-configuration-in)
- [Emissary has GitHub Actions Shell Injection via Workflow Inputs](https://junglewise.ai/threats/cve-2026-35580-emissary-has-github-actions-shell-injection-via-workflow-inputs)
- [Emissary has Stored XSS via Navigation Template Link Injection](https://junglewise.ai/threats/cve-2026-35571-emissary-has-stored-xss-via-navigation-template-link-injection)