---
id: "CVE-2026-62314"
kind: "vulnerability"
aliases: ["CVE-2026-62314", "GHSA-6wcg-mqvh-fcvg", "GO-2026-6639"]
title: "Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis"
severity: "medium"
cvss: 5.8
epss: 0.0027
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/TecharoHQ/anubis", "fixed": ["1.26.0"], "affected": ">= 1.22.0, < 1.26.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["anubis", "go", "package", "reverse-proxy", "self-hosted"]
not_affected_if: ["version-outside-1.22.0-to-1.26.0"]
published_at: "2026-07-15T22:17:38+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:48:49+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6639", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-62314", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62314", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis

Anubis versions 1.22.0 through 1.26.0-pre1 trust the client-supplied X-Original-URI header when matching policy paths. An attacker can send that header to match the default allow rules, such as ^/\.well-known/.*$, and skip the bot challenge to reach the protected upstream.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/TecharoHQ/anubis affected >= 1.22.0, < 1.26.0 fixed 1.26.0

## How to check

Check go.mod or go.sum for github.com/TecharoHQ/anubis at a version >= 1.22.0 and < 1.26.0.

## Fix

Upgrade github.com/TecharoHQ/anubis to 1.26.0 or later.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6639
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-62314
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62314

## From the sources

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_