CVE-2026-55252Medium· 5.1▾ TwilightPoC availableOpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 28.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 5.1
0.3%
Last analysed / modified upstream
Exploit / PoC code exists
0.3% → 0.4%
OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version 0.17.7.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/openrundev/openrun < 0.17.7Patched in:
github.com/openrundev/openrun 0.17.7Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101090Critical· 9.8Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint
CVE-2025-71405Medium· 5.1chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs
CVE-2026-54072Critical· 9.3Authorizer is an open-source, self-hostable authentication and authorization server
CVE-2026-115537Medium· 4.3gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
CVE-2026-112251Medium· 4.3antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
CVE-2026-112040Medium· 4.3diem-project diem Sign-In BasedmUserActions.class.php redirect