{"id":"CVE-2026-118681","kind":"vulnerability","aliases":["CVE-2026-118681"],"related":[],"title":"go-chi chi: SupressNotFound middleware lets unauthenticated requests skip mounted auth","description":"go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.","summary":"In go-chi/chi before 5.5.0, the middleware.SupressNotFound function leaves a mounted router's route parameters in place when it re-matches against the outer router. An unauthenticated attacker can request a mounted path whose suffix matches a public outer route, bypassing the mounted router's authentication middleware and reading tenant-scoped data if the outer handler trusts the retained parameter.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","go-chi","multi-tenant","package","self-hosted"],"not_affected_if":["chi-5.5.0-or-later","no-suppressnotfound"],"how_to_check":"- Check the chi version in go.mod with `go list -m github.com/go-chi/chi/v5` (or `github.com/go-chi/chi`)\n- Search the codebase for `SupressNotFound` with `grep -rn SupressNotFound .`\n- Look for `Mount` calls where authentication middleware is applied only inside the mounted router","fix":"- Upgrade github.com/go-chi/chi to `5.5.0` or later\n- Until upgraded, remove the SupressNotFound middleware or move authentication onto the outer router so it applies to every path","status":"open","published_at":"2026-10-28T19:17:34+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:36:09+00:00","updated_at":"2026-10-28T19:36:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T19:36:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade github.com/go-chi/chi to `5.5.0` or later\n- Until upgraded, remove the SupressNotFound middleware or move authentication onto the outer router so it applies to every path","reach":"internet","title":"go-chi chi: SupressNotFound middleware lets unauthenticated requests skip mounted auth","impact":"medium","summary":"In go-chi/chi before 5.5.0, the middleware.SupressNotFound function leaves a mounted router's route parameters in place when it re-matches against the outer router. An unauthenticated attacker can request a mounted path whose suffix matches a public outer route, bypassing the mounted router's authentication middleware and reading tenant-scoped data if the outer handler trusts the retained parameter.","category":"package","nicknames":[],"who_cares":["go","go-chi","self-hosted","multi-tenant"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker reads tenant-scoped data through public route","analyst_note":"Check the upstream go-chi/chi 5.5.0 release notes and the NVD entry for the exact affected middleware usage and whether the fix is available as a patch.","how_to_check":"- Check the chi version in go.mod with `go list -m github.com/go-chi/chi/v5` (or `github.com/go-chi/chi`)\n- Search the codebase for `SupressNotFound` with `grep -rn SupressNotFound .`\n- Look for `Mount` calls where authentication middleware is applied only inside the mounted router","needs_analyst":true,"not_affected_if":["chi-5.5.0-or-later","no-suppressnotfound"],"who_is_affected":"Applications that use go-chi/chi before 5.5.0 together with the SupressNotFound middleware, and that mount sub-routers protected by authentication middleware alongside public outer routes that read a mount parameter. Services that do not use SupressNotFound, or that enforce auth on the outer router, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":3376,"output_tokens":729,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118681':15A,18A '-2026':14A,17A '/chi':34B '5.5.0':36B,99C 'attack':60B,133C 'auth':12A 'authent':78B,102C,149C 'bypass':73B,103C 'call':107C 'chi':3A,4A,22B,33B,96C,97C 'child':122C 'contain':100C 'context':113C 'cve':13A,16A 'data':85B,156C 'dispatch':127C 'function':39B 'go':2A,19B,21B,32B,95C 'go-chi':1A,20B,31B,94C 'handler':89B,160C 'host':29B 'leav':40B,115C 'let':7A 'live':111C 'match':53B,68B,108C,141C 'middlewar':6A,79B,150C 'middleware.supressnotfound':38B,105C 'mount':11A,42B,64B,75B,117C,137C,148C,164C 'multi':24B 'multi-ten':23B 'outer':56B,71B,88B,130C,143C,159C 'packag':26B 'paramet':46B,93B,120C,165C 'path':65B,138C 'place':48B,125C 'public':70B,144C 're':52B 're-match':51B 'read':81B 'request':9A,62B,135C 'retain':92B,163C 'retriev':152C 'rout':45B,72B,112C,145C 'router':43B,57B,76B,118C,131C 'scope':84B,155C 'self':28B 'self-host':27B 'skip':10A,146C 'suffix':67B,123C,140C 'supressnotfound':5A 'tenant':25B,83B,154C 'tenant-scop':82B,153C 'trust':90B,161C 'unauthent':8A,59B,132C 'whose':66B,139C","nicknames":[],"mitigations":[],"who_affected":"Applications that use go-chi/chi before 5.5.0 together with the SupressNotFound middleware, and that mount sub-routers protected by authentication middleware alongside public outer routes that read a mount parameter. Services that do not use SupressNotFound, or that enforce auth on the outer router, are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118681","severity":null,"published_at":"2026-10-28T19:17:34+00:00","modified_at":"2026-10-28T19:17:35+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}