What’s Vulnerable › Vulnerabilities

CVE-2026-91143: goproxy through 15.3 Authentication Bypass via CONNECT

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-23
• Weakness: CWE-288

Description

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

Affected products

• snail007 goproxy: through 15.3

References

• https://github.com/geo-chen/oss/blob/main/goproxy.md
• https://github.com/snail007/goproxy
• https://github.com/snail007/goproxy/blob/v15.3/services/http.go
• https://github.com/snail007/goproxy/blob/v15.3/utils/structs.go
• https://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-via-connect

Get alerted when CVE-2026-91143 or the next vulnerability affects your stack