CVE-2026-49826

Description

Concourse login flow has an open redirect issue in github.com/concourse/concourse

How to fix CVE-2026-49826

To remediate CVE-2026-49826, upgrade the affected package to a fixed version below.

• Go/github.com/concourse/concourse—upgrade to 1.6.1-0.20260526150512-ac60be5f0435 or later
• Go/github.com/concourse/concourse—upgrade to 1.6.1-0.20260526150512-ac60be5f0435 or later

Is CVE-2026-49826 being exploited?

No exploitation signal available. Neither CISA KEV nor a current EPSS score has been published for CVE-2026-49826.

Affected packages (2)

• from 0, < 1.6.1-0.20260526150512-ac60be5f0435
• from 0, < 1.6.1-0.20260526150512-ac60be5f0435

CVSS scores

References (4)

• PATCHgithub.com/concourse/concourse
• WEBgithub.com/concourse/concourse/commit/ac60be5f0435b6592f5a4fcc089050d72ad2452c
• WEBgithub.com/concourse/concourse/releases/tag/v8.2.3
• WEBgithub.com/concourse/concourse/security/advisories/GHSA-8w27-c4vc-88q9