{"id":"CVE-2026-62314","kind":"vulnerability","aliases":["CVE-2026-62314","GHSA-6wcg-mqvh-fcvg","GO-2026-6639"],"related":[],"title":"Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis","description":"Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.","summary":"Anubis versions 1.22.0 through 1.26.0-pre1 trust the client-supplied X-Original-URI header when matching policy paths. An attacker can send that header to match the default allow rules, such as ^/\\.well-known/.*$, and skip the bot challenge to reach the protected upstream.","severity":"medium","cvss":5.8,"epss":0.0027,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/TecharoHQ/anubis","fixed":["1.26.0"],"affected":">= 1.22.0, < 1.26.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["anubis","go","package","reverse-proxy","self-hosted"],"not_affected_if":["version-outside-1.22.0-to-1.26.0"],"how_to_check":"Check go.mod or go.sum for github.com/TecharoHQ/anubis at a version >= 1.22.0 and < 1.26.0.","fix":"Upgrade github.com/TecharoHQ/anubis to 1.26.0 or later.","status":"open","published_at":"2026-07-15T22:17:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:48:49+00:00","updated_at":"2026-10-23T21:48:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:48:49Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/TecharoHQ/anubis to 1.26.0 or later.\nunknown","reach":"internet","impact":"medium","summary":"Anubis versions 1.22.0 through 1.26.0-pre1 trust the client-supplied X-Original-URI header when matching policy paths. An attacker can send that header to match the default allow rules, such as ^/\\.well-known/.*$, and skip the bot challenge to reach the protected upstream.","category":"package","who_cares":["anubis","self-hosted","go","reverse-proxy"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker bypasses bot challenge and reaches protected upstream resources unchallenged","analyst_note":"","how_to_check":"Check go.mod or go.sum for github.com/TecharoHQ/anubis at a version >= 1.22.0 and < 1.26.0.\nunknown","needs_analyst":false,"not_affected_if":["version-outside-1.22.0-to-1.26.0"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000787,"input_tokens":3026,"output_tokens":969,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A,28A '-62314':18A,29A '-6639':26A '/techarohq/anubis':15A,32A '1.22.0':44B,110C '1.26.0':46B,112C,155C '6wcg':21A 'ai':93C 'allow':72B,129C,137C 'anubi':1A,33B,42B,89C,147C 'attack':63B 'bot':82B,108C 'bypass':3A,145C 'challeng':83B,97C,148C 'client':5A,51B,119C,132C 'client-control':118C 'client-suppli':50B 'connect':99C 'control':6A,120C 'cve':16A,27A 'data/common/keep-internet-working.yaml':136C 'default':71B,135C 'fcvg':23A 'firewal':94C 'fix':152C 'ghsa':20A 'ghsa-6wcg-mqvh-fcvg':19A 'github.com':14A,31A 'github.com/techarohq/anubis':13A,30A 'go':24A,34B 'header':11A,57B,67B,125C 'host':41B 'http':131C 'issu':150C 'known':78B,143C 'lib/policy/checker.go':114C 'match':59B,69B,127C,134C 'mqvh':22A 'order':101C 'origin':9A,55B,123C 'packag':35B 'path':61B 'pathchecker.check':115C 'polici':2A,60B 'pre1':47B,113C,156C 'protect':87B,103C 'proxi':38B 'r.url.path':128C 'reach':85B 'resourc':105C 'revers':37B 'reverse-proxi':36B 'rule':73B,138C 'scraper':107C 'self':40B 'self-host':39B 'send':65B 'skip':80B 'suppli':52B 'trust':48B,116C 'upstream':88B,104C 'uri':10A,56B,124C 'user':98C 'util':95C 'version':43B,154C 'via':4A 'web':92C 'well':77B,142C 'well-known':76B,141C 'x':8A,54B,122C 'x-original-uri':7A,53B,121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-15T22:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6639","url":"https://pkg.go.dev/vuln/GO-2026-6639","severity":null,"published_at":"2026-10-07T14:10:14+00:00","modified_at":"2026-10-07T14:10:14+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62314","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62314","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62314","severity":null,"published_at":"2026-07-15T22:17:38+00:00","modified_at":"2026-08-12T18:17:38+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}