---
id: "CVE-2026-118681"
kind: "vulnerability"
aliases: ["CVE-2026-118681"]
title: "go-chi chi: SupressNotFound middleware lets unauthenticated requests skip mounted auth"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["go", "go-chi", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["chi-5.5.0-or-later", "no-suppressnotfound"]
published_at: "2026-10-28T19:17:34+00:00"
first_seen_at: "2026-10-28T19:34:55+00:00"
updated_at: "2026-10-28T19:36:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118681", "first_seen_at": "2026-10-28T19:34:55+00:00"}]
---

# go-chi chi: SupressNotFound middleware lets unauthenticated requests skip mounted auth

In go-chi/chi before 5.5.0, the middleware.SupressNotFound function leaves a mounted router's route parameters in place when it re-matches against the outer router. An unauthenticated attacker can request a mounted path whose suffix matches a public outer route, bypassing the mounted router's authentication middleware and reading tenant-scoped data if the outer handler trusts the retained parameter.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the chi version in go.mod with `go list -m github.com/go-chi/chi/v5` (or `github.com/go-chi/chi`)
- Search the codebase for `SupressNotFound` with `grep -rn SupressNotFound .`
- Look for `Mount` calls where authentication middleware is applied only inside the mounted router

## Fix

- Upgrade github.com/go-chi/chi to `5.5.0` or later
- Until upgraded, remove the SupressNotFound middleware or move authentication onto the outer router so it applies to every path

## Timeline

- 2026-10-28T19:34:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118681

## From the sources

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_