Vulnerability Description
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/geo-chen/oss/blob/main/goproxy.md
- https://github.com/snail007/goproxy
- https://github.com/snail007/goproxy/blob/v15.3/services/http.go
- https://github.com/snail007/goproxy/blob/v15.3/utils/structs.go
- https://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-
FAQ
What is CVE-2026-91143?
CVE-2026-91143 is a vulnerability with a CVSS score of 7.2 (HIGH). goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests...
How severe is CVE-2026-91143?
CVE-2026-91143 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-91143?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.