CVE-2026-44971 GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Attackers can trigger SSRF and steal GitHub tokens by manipulating repository URLs during remote project scanning in GuardDog.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44971?
CVE-2026-44971 is a high-severity server-side request forgery vulnerability in DataDog guarddog, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the GH_TOKEN used by GuardDog. This vulnerability is fixed in .
Weakness: CWE-918
Which versions are affected by CVE-2026-44971?
3 open source packages ship an affected version, including guarddog.
| Package | Affected | Fixed in |
|---|---|---|
guarddog PyPI | From 1.0.0 to 2.9.0 | None |
guarddog PyPI | From 1.0.0 to 2.9.0 | None |
guarddog PyPI | From 1.0.0 to 2.9.0 | None |
How do I fix CVE-2026-44971?
No fix has been published for CVE-2026-44971 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-44971 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44971 exists.
Sources
Also known as GHSA-587r-mc96-6f2p, PYSEC-2026-2505.