Description

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-20T19:16:53.757Z",
  "pubdate": "2026-08-20T19:16:53.757Z",
  "executiveSummary": "A cross-origin redirect vulnerability exists in the SecureDrop Client prior to version 1.3.1.\nThe vulnerability allows a malicious SecureDrop Server to bypass securedrop-proxy's origin limitation mechanism by returning specially crafted cross-origin HTTP redirects.\nSecureDrop Client is a desktop application utilized by journalists for secure communications and submission handling on the SecureDrop Workstation.\nAlthough SecureDrop Server incorporates multiple layers of built-in hardening and operates as a dedicated physical machine exposed exclusively via Tor hidden services, a compromised or malicious server could leverage this flaw to subvert origin enforcement boundaries.\nSuccessful exploitation enables unauthorized cross-origin requests through the proxy layer, potentially exposing the workstation context to unintended server responses or interactions outside the designated origin scope.\nPrerequisites for exploitation require a malicious or compromised SecureDrop Server interacting with the targeted SecureDrop Workstation.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient validation and handling of HTTP redirect responses processed by securedrop-proxy within the SecureDrop Client prior to version 1.3.1.\nDuring communication between the SecureDrop Workstation and its dedicated SecureDrop Server, the client relies on securedrop-proxy to enforce strict origin limitations, ensuring that requests and responses remain strictly bound to the authorized server origin.\nAn attacker controlling a malicious SecureDrop Server can initiate the attack flow by responding to legitimate client requests with HTTP redirect instructions pointing to arbitrary cross-origin resources or endpoints.\nBecause the proxy fails to properly restrict or validate these redirect chains, the securedrop-proxy origin limitation is bypassed, causing the client context to follow the redirection sequence to the unauthorized origin.\nThe vulnerable component is the securedrop-proxy integration within the SecureDrop Client across versions prior to 1.3.1.\nThe network exposure involves Tor hidden services utilized for communication between the newsroom's SecureDrop Workstation and its dedicated SecureDrop Server.\nAuthentication and privilege requirements for the attack vector assume interaction with or control over the dedicated SecureDrop Server communicating with the workstation.\nPost-exploitation impact includes the potential circumvention of client-side origin boundaries, allowing a malicious server to direct traffic flow outside expected operational parameters and interact with resources restricted by the proxy policy."
}