CVE-2026-44971: GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

Synopsis

A server-side request forgery (SSRF) vulnerability exists in GuardDog, a CLI tool for identifying malicious PyPI packages, versions 1.0.0 through 2.9.0. The flaw is reachable over the network with no authentication required: when GuardDog's remote project scanning path rewrites an attacker-controlled repository URL using a blind string replacement, it forwards the caller's GitHub credentials (GH_TOKEN) with the resulting outbound request. Successful exploitation lets an attacker redirect that credentialed request to an arbitrary destination and capture the GH_TOKEN. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to influence the repository URL that GuardDog fetches over the network, exposing the SSRF path to any caller that can supply or manipulate scan input remotely.

• AuthenticationNot required

  No credentials or account are required to trigger the vulnerability; the attacker only needs to control the repository URL supplied to GuardDog.

• Victim interactionNot required

  No user interaction is needed beyond the normal execution of a GuardDog remote project scan with an attacker-influenced URL.

• Attack complexityDetail

  Exploit complexity is low: no race conditions or special environmental factors are required; a crafted repository URL is sufficient to trigger the SSRF and credential forwarding.

Blast Radius

• Reads the GH_TOKEN present in the scanning environment, granting the attacker whatever GitHub API access that token carries, which may include access to private repositories, organization membership, and workflow secrets.
• Exfiltrates the token to an attacker-controlled server via the SSRF-redirected credentialed HTTP request, making the exposure persistent until the token is rotated.
• Allows the attacker to make authenticated GitHub API calls on behalf of the token holder, including reading source code, listing collaborators, and triggering repository actions.