CVE-2026-49826 Concourse login flow has an open redirect issue
Attackers can craft URLs to redirect users from Concourse to malicious sites, facilitating phishing attacks to steal credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-49826?
CVE-2026-49826 is a vulnerability in concourse, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has been fixed in 8.2.3. No known workarounds are available.
Weakness: CWE-601
Which versions are affected by CVE-2026-49826?
4 open source packages ship an affected version, including github.com/concourse/concourse and concourse.
| Package | Affected | Fixed in |
|---|---|---|
github.com/concourse/concourse Go | All versions | 1.6.1-0.20260526150512-ac60be5f0435 |
github.com/concourse/concourse Go | All versions | 1.6.1-0.20260526150512-ac60be5f0435 |
github.com/concourse/concourse Go | All versions | 1.6.1-0.20260526150512-ac60be5f0435 |
concourse Bitnami | All versions | 8.2.3 |
How do I fix CVE-2026-49826?
Upgrade github.com/concourse/concourse to 1.6.1-0.20260526150512-ac60be5f0435 or later.
Is CVE-2026-49826 being exploited?
There is no known exploitation of CVE-2026-49826 in the wild and no public exploit code.
Sources
Also known as BIT-concourse-2026-49826, GHSA-8w27-c4vc-88q9, GO-2026-5866.