GHSA-8w27-c4vc-88q9

Source

https://github.com/advisories/GHSA-8w27-c4vc-88q9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8w27-c4vc-88q9/GHSA-8w27-c4vc-88q9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8w27-c4vc-88q9

Aliases

Published

2026-07-01T19:01:16Z

Modified

2026-08-19T09:55:28Z

Severity

0.0 (None) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Concourse login flow has an open redirect issue

Details

Impact

An attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials.

Patches

This has been fixed in 8.2.3

Workarounds

None.

Exploit

Vulnerable code was in: https://github.com/concourse/concourse/blob/ea7b812e3a88fdd070f0faece874e8a2d4fbb31c/skymarshal/skyserver/skyserver.go#L162-L170

The issue stems from the underlying processing logic of Go's url package. Normally, ParseRequestURI() will eventually reach an internal url.setPath() function, where the URL will be decoded. However, if RawPath is not empty and validEncoded(RawPath) is true, and the decoded result equals Path, then return RawPath as is; otherwise, escape Path again, i.e., decode it again.

In other words, if the URL contains dangerous characters that should be escaped, such as backslashes (\), then an extra decoding step will be performed. Therefore, /%2Fexample.com will be parsed as //example.com.

On vulnerable versions of Concourse, add /sky/login?redirect_uri=/%252Fexample.com/\ to your Concourse external URL, login as usual, and you should be redirected to example.com instead of your Concourse web server. The redirect happens after the login flow completes. No credentials are leaked.

Database specific

{
    "cwe_ids":  [
        "CWE-601"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-01T19:01:16Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/concourse/concourse

Package

Name: github.com/concourse/concourse; View open source insights on deps.dev
Purl: pkg:golang/github.com/concourse/concourse

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.1-0.20260526150512-ac60be5f0435

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8w27-c4vc-88q9/GHSA-8w27-c4vc-88q9.json"