Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-44971GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

High 8.2

In plain English

A high-severity server-side request forgery in guarddog from DataDog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.2%top 84.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and capture the GH_TOKEN used by GuardDog. This vulnerability is fixed in .

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	guarddog	no fix listed	GHSA-587r-mc96-6f2p
PyPI	guarddog	no fix listed	PYSEC-2026-2505

Affected products (as reported)

Vendor	Product	Versions
DataDog	guarddog	>= 1.0.0, <= 2.9.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/DataDog/guarddog/security/advisories/GHSA-587r-mc96-6f2p x_refsource_CONFIRM