CVE-2026-68548 · Runtime
NO FIX YET · SEE WHAT TO DO
Algernon checks protected URL prefixes like /admin case-sensitively, but the filesystem lookup ignores case on Windows and macOS. A request for /Admin/secret.lua skips the check and reads or runs protected files without logging in.
first public Jul 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Algernon servers before 1.17.10 running on case-insensitive filesystems (Windows NTFS, macOS APFS or HFS+ by default) with the permission system active, which is its default configuration. Linux servers with case-sensitive filesystems are not affected by this path, and sites that do not serve /admin, /repo or /data protected content have less exposure.
Not affected if case-sensitive-filesystem, no-protected-content, version-1.17.10-or-later
Who cares algernon, go, macos, self-hosted, windows
algernon --version or the version in the project's go.mod, below 1.17.10 means affected1.17.10Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.