CVE-2026-91143CWE-288

CVE-2026-91143

High · published September 15, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00466 · 39.4th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-09-15T02:16Z
References (5)
https://github.com/geo-chen/oss/blob/main/goproxy.md · [email protected]https://github.com/snail007/goproxy · [email protected]https://github.com/snail007/goproxy/blob/v15.3/services/http.go · [email protected]https://github.com/snail007/goproxy/blob/v15.3/utils/structs.go · [email protected]https://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-via-connect · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 21:45Z
    goproxy through 15.3 Authentication Bypass via CONNECT
    cvelistv5