What’s Vulnerable › Vulnerabilities

CVE-2026-0650: OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-07 · updated 2026-10-26
• Weakness: CWE-306

Description

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.

Affected products

• OpenFlagr Flagr: through 1.1.18

References

• https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass
• https://github.com/openflagr/flagr/releases/tag/1.1.19
• https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization

Get alerted when CVE-2026-0650 or the next vulnerability affects your stack