CVE-2026-44971 Details
Description
GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the GH_TOKEN used by GuardDog. This vulnerability is fixed in .
A server-side request forgery (SSRF) vulnerability has been identified in GuardDog, a command-line tool for detecting malicious PyPI packages. This issue affects versions 1.0.0 through 2.9.0. The vulnerability arises because the tool's remote project scanning feature blindly rewrites repository URLs controlled by attackers. It then sends the modified request along with the user's GitHub credentials, specifically the GH_TOKEN, via HTTP Basic Authentication. As a result, an attacker who can manipulate the scanned URL could intercept the GitHub token and potentially access sensitive information or perform actions on behalf of the user.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DataDog/guarddog/security/advisories/GHSA-587r-mc96-6f2p | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/DataDog/guarddog/security/advisories/GHSA-587r-mc96-6f2p | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DataDog GuardDog | >= 1.0.0, <= 2.9.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |