Live › vulnerability › CVE-2026-118681
Go to dashboardIn go-chi/chi before 5.5.0, the middleware.SupressNotFound function leaves a mounted router's route parameters in place when it re-matches against the outer router. An unauthenticated attacker can request a mounted path whose suffix matches a public outer route, bypassing the mounted router's authentication middleware and reading tenant-scoped data if the outer handler trusts the retained parameter.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Applications that use go-chi/chi before 5.5.0 together with the SupressNotFound middleware, and that mount sub-routers protected by authentication middleware alongside public outer routes that read a mount parameter. Services that do not use SupressNotFound, or that enforce auth on the outer router, are not exposed by this flaw.
No product ranges from the sources yet.
go list -m github.com/go-chi/chi/v5 (or github.com/go-chi/chi)SupressNotFound with grep -rn SupressNotFound .Mount calls where authentication middleware is applied only inside the mounted router5.5.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
This page as .md · .json · in your agent: get_signal("CVE-2026-118681")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.