CVE-2026-55252CWE-601

CVE-2026-55252

published October 2, 2026

CVSS
5.1
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version 0.17.7.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00321 · 24.0th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-10-02T00:17Z
References (4)
https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0 · [email protected]https://github.com/openrundev/openrun/releases/tag/v0.17.7 · [email protected]https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37 · [email protected]https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 01 OCT 19:52Z
    OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect
    cvelistv5