Input validation error in GuardDog - #VU130480
Published: May 7, 2026
Vulnerability identifier: #VU130480
CSH Severity: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
GuardDog
GuardDog
Software vendor:
DataDog
DataDog
Description
The vulnerability allows a remote attacker to disclose sensitive information and perform server-side request forgery.
The vulnerability exists due to improper input validation in ProjectScanner.scan_remote() when processing attacker-controlled repository URLs. A remote attacker can supply a crafted repository URL to disclose sensitive information and perform server-side request forgery.
The issue can expose the configured GH_TOKEN through HTTP Basic Auth and can direct requests to internal or localhost services reachable by the scanner.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.