Live › vulnerability › CVE-2026-62314
Go to dashboardAnubis versions 1.22.0 through 1.26.0-pre1 trust the client-supplied X-Original-URI header when matching policy paths. An attacker can send that header to match the default allow rules, such as ^/\.well-known/.*$, and skip the bot challenge to reach the protected upstream.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/TecharoHQ/anubis | go | >= 1.22.0, < 1.26.0 | 1.26.0 |
Check go.mod or go.sum for github.com/TecharoHQ/anubis at a version >= 1.22.0 and < 1.26.0.
Upgrade github.com/TecharoHQ/anubis to 1.26.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.
This page as .md · .json · in your agent: get_signal("CVE-2026-62314")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.