OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-55252 · Microsoft / collected KEV context

EUVD-2026-91046

GHSA-h5g6-xmh4-hc37

GO-2026-5956

cve-program · CVE-2026-55252

• https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
• https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0
• https://github.com/openrundev/openrun/releases/tag/v0.17.7

euvd · EUVD-2026-91046

• https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
• https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0
• https://github.com/openrundev/openrun/releases/tag/v0.17.7

nvd · CVE-2026-55252

• https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0
• https://github.com/openrundev/openrun/releases/tag/v0.17.7
• https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37

osv · GHSA-h5g6-xmh4-hc37

• https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
• https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0
• https://github.com/openrundev/openrun
• https://github.com/openrundev/openrun/releases/tag/v0.17.7

osv · GO-2026-5956

• https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
• https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0
• https://github.com/openrundev/openrun/releases/tag/v0.17.7

No related operational record is retained in the current change model.