CVE-2026-42329: Iris Open Redirect Vulnerability (v2.4.28 Fix)

Technical summary

CVE-2026-42329 is an open redirect vulnerability (CWE-602) affecting Iris collaborative platform versions prior to 2.4.28. The application fails to properly validate and sanitize redirection destinations, allowing an attacker to embed a malicious external URL that the application will redirect users to without adequate warning or validation. The vulnerability requires user interaction (clicking a link) and operates over the network. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) reflects a network-accessible attack with low complexity, no privilege requirement, required user interaction, and integrity impact across trust boundaries.

Business impact

The reputational and operational risk stems from Iris's role as a trusted platform within incident response teams. An attacker who successfully executes this redirect could harvest credentials, deliver malware, or conduct phishing attacks against security personnel—typically high-value targets. During active incident investigations, users are likely under time pressure and may be less vigilant about link destinations. Compromise of incident responder credentials or systems could expose sensitive investigation data or provide lateral movement opportunities into the organizations those responders represent.

Affected systems

Iris versions prior to 2.4.28 are affected. Users running version 2.4.28 or later are not vulnerable to this specific issue. The platform's use is concentrated among security operations and incident response teams, so exposure is primarily within organizations that deploy Iris for collaborative incident handling.

Exploitability

Exploitability is straightforward but bounded by user interaction requirements. An attacker must craft a malicious link and introduce it into Iris (or trick a user into visiting one externally), then rely on the user clicking it. There is no indication of public exploit code or active exploitation in the wild at this time. The lack of CISA KEV designation confirms this has not been observed as exploited in active campaigns. The barrier to exploitation is low from a technical standpoint, but social engineering barriers exist in practice.

Remediation

Upgrade Iris to version 2.4.28 or later. This version includes fixes for the open redirect vulnerability. Users unable to upgrade immediately should educate incident response teams to scrutinize links shared within Iris and avoid clicking unexpected external redirects, particularly those that deviate from known trusted domains.

Patch guidance

Verify with your Iris deployment provider or consult the official Iris release notes to confirm the availability and compatibility of version 2.4.28 for your environment. Test the upgrade in a non-production incident response sandbox first if possible to ensure no disruption to active investigations. Plan the upgrade during a maintenance window to minimize operational friction. After patching, validate that link handling within the platform works as expected and that the redirect validation logic is in place.

Detection guidance

Monitor web proxy and firewall logs for unexpected external redirects originating from Iris users. Look for patterns of access to known phishing or credential-harvesting domains from within your incident response infrastructure. Within Iris logs (if available), track redirect events and flag any that point to non-whitelisted external domains. Endpoint detection should monitor for suspicious process execution or credential access immediately following Iris usage, which could indicate successful post-redirect compromise.

Why prioritize this

Although the CVSS score is MEDIUM (4.7), prioritization should account for the high-value nature of incident responders as targets and the privileged context in which they operate. Iris is typically used by security teams with broad system access, making their compromise strategically significant. However, the requirement for user interaction and the absence of active exploitation mean this should not preempt patches for critical or high-severity vulnerabilities affecting primary systems. Treat as a targeted hardening effort rather than an emergency.

Risk score, explained

The CVSS 3.1 score of 4.7 (MEDIUM) reflects a network-accessible attack with no privilege or special complexity requirements, but one that fundamentally requires user interaction to succeed. There is no confidentiality impact, only integrity impact (the user is redirected to an attacker-controlled site). The scope is changed, indicating the impact crosses a trust boundary. This score appropriately captures the social engineering and trust-exploitation nature of the vulnerability while acknowledging that technical exploitation alone is insufficient.

Frequently asked questions