Input validation error in GuardDog - CVE-2026-44971
Published: May 7, 2026
Vulnerability identifier: #VU130480
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-44971
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and perform server-side request forgery.
The vulnerability exists due to improper input validation in ProjectScanner.scan_remote() when processing attacker-controlled repository URLs. A remote attacker can supply a crafted repository URL to disclose sensitive information and perform server-side request forgery.
The issue can expose the configured GH_TOKEN through HTTP Basic Auth and can direct requests to internal or localhost services reachable by the scanner.
Affected software
GuardDog
How to mitigate CVE-2026-44971
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.