CVE-2026-55252 MEDIUM

CVE-2026-55252: OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect

Vendor Openrundev

Product openrun

Weakness CWE-601 · Open redirect

Published October 1, 2026

Last update October 1, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version 0.17.7.

Key dates

02Disclosure timeline

October 1, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-55252 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html AskarLabs — CWE-601 write-up URL Redirection to Untrusted Site (Open Redirect)

Related vulnerabilities

CVE-2026-55252: OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect

01Description

02Disclosure timeline

03References

04Related CVE