PT-2026-39677 · Datadog+1 · Guarddog

Bg0D-Glitch · Published 2026-05-11 · Updated 2026-05-27 · CVE-2026-44971

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions GuardDog versions 1.0.0 through 2.9.0

Description The programmatic remote project scanning path in the ProjectScanner.scan remote() function rewrites attacker-controlled repository URLs using blind string replacement before sending the caller's GitHub credentials with the request. Because the logic fails to parse or validate the hostname, a crafted URL can trigger Server-Side Request Forgery (SSRF), allowing an attacker to capture the GH TOKEN used by the tool. This occurs when the software replaces the string "github" with "raw.githubusercontent" without verifying the destination, leading the system to send HTTP Basic Auth credentials to an arbitrary host.

Recommendations Update GuardDog to a version later than 2.9.0. As a temporary workaround, restrict the use of the ProjectScanner.scan remote() function to trusted repository URLs only.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-44971

GHSA-587R-MC96-6F2P

Affected Products

Guarddog

References · 4

• 🔥 https://github.com/DataDog/guarddog/security/advisories/GHSA-587r-mc96-6f2p · Exploit
• https://osv.dev/vulnerability/GHSA-587r-mc96-6f2p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44971 · Security Note
• https://github.com/DataDog/guarddog · Note