CVE-2026-54893 swoosh CVE debrief

Who should care

Defenders responsible for Swoosh deployments, especially those using user-influenced input for the 'from' address, should assess exposure and verify URL encoding and validation. This includes reviewing compensating controls, monitoring for unusual activity, and ensuring proper configuration of the Microsoft Graph adapter.

Why it matters

CVE-2026-54893 is a low-severity vulnerability in Swoosh's Microsoft Graph adapter, allowing URL path injection. Defenders should verify 'from' address validation and URL encoding, especially in deployments using user-influenced input.

• Potential unauthorized Microsoft Graph API requests
• Possible elevation of privileges within Graph scopes
• Required verification of 'from' address validation and URL encoding
• Need for monitoring unusual Graph API request patterns

Technical summary

The Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path without proper encoding or validation. This allows attackers to inject URL-special characters and potentially redirect requests to other Graph endpoints within the token's scopes. The vulnerability affects Swoosh versions from 1.12.0 before 1.26.3. Applications that always use a fixed, trusted 'from' address are not affected. Defenders should prioritize verifying the 'from' address validation and URL encoding in Swoosh deployments.

Defensive priority

Defenders should prioritize verifying the 'from' address validation and URL encoding in Swoosh deployments, especially those using user-influenced input.

Recommended defensive actions

• Verify Swoosh version and update to 1.26.3 or later if necessary
• Review 'from' address validation and URL encoding in Swoosh deployments
• Monitor for unusual Microsoft Graph API requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but specific exploitation or impact data is limited. The Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path without proper encoding or validation. This allows attackers to inject URL-special characters and potentially redirect requests to other Graph endpoints within the token's scopes. There is no evidence of public exploitation, but defenders should prioritize verifying the 'from' address.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.