CVE-2026-49826
Unknown
Description
Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has been fixed in 8.2.3. No known workarounds are available.
SeverityUnknown
CVSS0.0
Exploit probability—
ProductGithub.com/concourse/concourse
PublishedAug 14, 2026
First seenAug 14, 2026
Weakness typeCWE-601Open redirect
How to fix
Update
- github.com/concourse/concourse1.6.1-0.20260526150512-ac60be5f0435 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/concourse/concourseGo | v < 1.6.1-0.20260526150512-ac60be5f0435 | 1.6.1-0.20260526150512-ac60be5f0435 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.