---
id: CVE-2026-55252
title: >-
  OpenRun is an open-source, self-hosted GitOps platform for deploying web apps
  and internal tools to Docker or Kubernetes
summary: >-
  OpenRun is an open-source, self-hosted GitOps platform for deploying web apps
  and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the
  restrictions on redirect URLs in openrun can be bypassed by attackers, leading
  to open…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N'
cwe:
  - CWE-601
vendor: openrundev
product: openrun
affected:
  - openrun < 0.17.7
patched:
  - github.com/openrundev/openrun 0.17.7
published: '2026-10-01'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:17:07.523'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55252'
references:
  - url: >-
      https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0
    label: security-advisories@github.com
  - url: 'https://github.com/openrundev/openrun/releases/tag/v0.17.7'
    label: security-advisories@github.com
  - url: >-
      https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
    label: security-advisories@github.com
  - url: >-
      https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-h5g6-xmh4-hc37'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - exploit-available
epss: 0.00408
epssPercentile: 0.34899
aliases:
  - GHSA-h5g6-xmh4-hc37
ecosystem: go
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-01T20:02:55.390672Z'
cvssSource: cna
ingestedAt: '2026-07-09T23:53:27.227Z'
---

## Overview

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version 0.17.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55252)

Affected packages:

- `github.com/openrundev/openrun < 0.17.7`

Patched in:

- `github.com/openrundev/openrun 0.17.7`

Source: https://github.com/advisories/GHSA-h5g6-xmh4-hc37