CVE-2026-49826: 
Concourse CI vulnerability analysis and mitigation

CVE-2026-49826 is an open redirect vulnerability in the Concourse CI/CD platform's login flow that allows an unauthenticated attacker to craft a malicious URL redirecting users to an arbitrary external site after completing authentication. It affects all Concourse versions prior to 8.2.3 (Go module versions < 1.6.1-0.20260526150512-ac60be5f0435). The vulnerability was published on May 27, 2026, and assigned a CVSS v4 base score of 0.0 (Low severity) — reflecting that no direct system impact occurs, though the phishing risk is real (Github Advisory, Concourse Advisory).

The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect) in skymarshal/skyserver/skyserver.go. The vulnerable Redirect() function prepended a / to the user-supplied redirect_uri parameter and passed it to Go's url.ParseRequestURI(), intending to enforce same-origin redirects. However, Go's internal url.setPath() performs an extra decode step when the URL contains characters like backslashes (\), causing a double-encoded payload such as /%252Fexample.com/\ to be decoded first to /%2Fexample.com/\, and then to //example.com — a protocol-relative URL pointing to an external host. An attacker can exploit this by appending /sky/login?redirect_uri=/%252Fexample.com/\ to the Concourse external URL; after the victim completes the normal login flow, they are silently redirected to the attacker-controlled site (Concourse Advisory, Fix Commit).

Successful exploitation does not compromise the Concourse server itself — there is no direct confidentiality, integrity, or availability impact on the system. The primary risk is phishing: a victim who clicks a crafted link and completes login is transparently redirected to an attacker-controlled site, where their Concourse credentials or session tokens could be harvested via a fake login page. The attack is particularly effective because the redirect URL appears to originate from the legitimate Concourse domain, lending it credibility (Github Advisory).

No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" at time of publication. The EPSS score is approximately 0.299% (22nd percentile), indicating a low near-term exploitation probability. No exploit kits or weaponized tools are known; however, the exploit technique is trivially reproducible from the public advisory, which includes the exact payload (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Concourse web servers running versions prior to 8.2.3 using tools like Shodan or Censys, or by checking the Concourse version endpoint.
2. Set up a phishing site: Deploy a convincing replica of the target organization's Concourse login page or credential-harvesting page at an attacker-controlled domain (e.g., attacker.example.com).
3. Craft the malicious URL: Construct a redirect URL using double-encoded path separators and a trailing backslash to bypass the same-origin check. Example payload appended to the Concourse base URL:

   https://concourse.victim.org/sky/login?redirect_uri=/%252Fattacker.example.com/\

4. Deliver the link: Send the crafted URL to the target user via email, chat, or other phishing vector. The URL appears to originate from the legitimate Concourse domain.
5. Victim completes login: The victim authenticates normally through the Concourse login flow. No credentials are intercepted at this stage.
6. Redirect occurs: After successful authentication, Concourse's Redirect() function decodes the double-encoded URI, resolving it to //attacker.example.com, and issues an HTTP redirect to the attacker's site.
7. Credential harvesting: The victim lands on the attacker-controlled phishing page, where credentials or session tokens may be captured (Concourse Advisory, Fix Commit).

• Network: HTTP requests to /sky/login with a redirect_uri parameter containing percent-encoded sequences such as %252F, %25252F, or %5C / %255C; outbound HTTP 302 redirects from the Concourse server to external (non-Concourse) hostnames following a login event.
• Logs: Concourse web access logs showing GET or POST requests to /sky/login?redirect_uri= with double-encoded or backslash-containing values; log entries from skymarshal containing invalid-redirect or failed-to-parse-redirect-url errors (present in patched versions when blocking such attempts).
• Logs: Unusual post-authentication redirect destinations in web server or proxy logs that point to external domains rather than the Concourse base URL.

Upgrade Concourse to version 8.2.3 or later, which resolves the vulnerability by iteratively unescaping the redirect_uri parameter (up to 5 times) before parsing, and explicitly rejecting URIs containing backslashes or resolving to protocol-relative paths (//). No configuration-based workarounds are available for unpatched versions. Organizations unable to upgrade immediately should consider placing a WAF rule to block requests to /sky/login where redirect_uri contains %25, %5C, or backslash characters (Concourse Advisory, v8.2.3 Release).