CVE-2026-34206: Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-31 · updated 2026-07-24
Weakness: CWE-79

Description

Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet. Prior to version 1.12.2, a reflected cross-site scripting (XSS) vulnerability exists in github.com/libops/captcha-protect. The challenge page accepted a client-supplied destination value and rendered it into HTML using Go's text/template. Because text/template does not perform contextual HTML escaping, an attacker could supply a crafted destination value that breaks out of the hidden input attribute and injects arbitrary script into the challenge page. This issue has been patched in version 1.12.2.

Affected products

libops captcha-protect: before 1.12.2 — fixed in 1.12.2

How to fix

Upgrade to a fixed version: libops captcha-protect 1.12.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-34206 or the next vulnerability affects your stack