Path Traversal Vulnerability in Emissary Data Workflow Engine
CVE-2026-35583

5.3MEDIUM

Key Information:

Vendor

Nationalsecurityagency

Status
Emissary
Vendor
CVE Published:
7 April 2026

What is CVE-2026-35583?

The Emissary data-driven workflow engine, prior to version 8.39.0, contains a vulnerability in its configuration API endpoint (/api/configuration/{name}). This endpoint utilized a blacklist for validation, which could be circumvented through URL-encoded variations, double-encoding, or Unicode normalization techniques. Such exploits may lead to unauthorized access to configuration files located outside the designated directory structure, potentially compromising sensitive data. The issue has been addressed in version 8.39.0.

Affected Version(s)

emissary < 8.39.0

References

https://github.com/NationalSecurityAgency/emissary/securi...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.