Medium severity · published Oct 1, 2026
CVE-2026-55252
OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version 0.17.7.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openrun · openrundev
< 0.17.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55252
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55252
x_refsource_CONFIRM
https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
x_refsource_MISC
https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0
x_refsource_MISC
https://github.com/openrundev/openrun/releases/tag/v0.17.7