CVE-2026-49996: securedrop-proxy origin limitation can be bypassed with redirects
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SecureDrop Client/Workstation component using securedrop-proxyto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using SecureDrop Client before version 1.3.1 are affected if their dedicated SecureDrop Server is malicious or compromised and responds with cross-origin redirects. A newsroom Workstation communicates only with its own dedicated SecureDrop Server, limiting exposure to that server relationship.
What does an attacker need to exploit this issue?
The attacker needs control of, or the ability to make malicious responses from, the SecureDrop Server used by the Workstation. Exploitation relies on that server returning cross-origin redirects to bypass securedrop-proxy's origin limitation.
Is immediate upgrading available?
Yes. Version 1.3.1 fixes the issue.