Open Redirect and Server-Side Request Forgery Vulnerability in Emissary Workflow Engine
CVE-2026-54442

4.8MEDIUM

Key Information:

Vendor: Nationalsecurityagency
Status: Emissary
Vendor: CVE Published:; 5 November 2026

🔔 Create Nationalsecurityagency Vulnerability Alert

What is CVE-2026-54442?

Emissary, a P2P-based data-driven workflow engine, prior to version 8.51.0, contains a vulnerability in the VALID_LINK validation mechanism. This flaw allows protocol-relative URLs to be accepted in configured navigation links, which can be manipulated by browser URL normalization to interpret these links as external origins. Such behavior can lead to potential open redirection and server-side request forgery attacks, posing risks to the application's integrity and data security. The issue has been addressed in version 8.51.0.