{"id":"CVE-2026-68548","kind":"vulnerability","aliases":["CVE-2026-68548"],"related":[],"title":"Algernon web server: case-changed URLs bypass admin and data access checks","description":"Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.","summary":"Algernon checks protected URL prefixes like /admin case-sensitively, but the filesystem lookup ignores case on Windows and macOS. A request for /Admin/secret.lua skips the check and reads or runs protected files without logging in.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["algernon","go","macos","runtime","self-hosted","windows"],"not_affected_if":["case-sensitive-filesystem","no-protected-content","version-1.17.10-or-later"],"how_to_check":"- `algernon --version` or the version in the project's go.mod, below `1.17.10` means affected\n- Check whether the server runs on Windows or macOS, where the bypass applies","fix":"- Algernon: `1.17.10`","status":"open","published_at":"2026-11-12T20:18:51+00:00","first_seen_at":"2026-11-12T20:40:27+00:00","triaged_at":"2026-11-12T20:41:51+00:00","updated_at":"2026-11-12T20:41:51+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-12T20:41:51Z","model":"claude-haiku-5-5","output":{"fix":"- Algernon: `1.17.10`","reach":"internet","title":"Algernon web server: case-changed URLs bypass admin and data access checks","impact":"high","summary":"Algernon checks protected URL prefixes like /admin case-sensitively, but the filesystem lookup ignores case on Windows and macOS. A request for /Admin/secret.lua skips the check and reads or runs protected files without logging in.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["algernon","go","windows","macos","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attacker reads and runs protected Lua files","analyst_note":"","how_to_check":"- `algernon --version` or the version in the project's go.mod, below `1.17.10` means affected\n- Check whether the server runs on Windows or macOS, where the bypass applies","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.17.10-or-later","case-sensitive-filesystem","no-protected-content"],"who_is_affected":"Algernon servers before 1.17.10 running on case-insensitive filesystems (Windows NTFS, macOS APFS or HFS+ by default) with the permission system active, which is its default configuration. Linux servers with case-sensitive filesystems are not affected by this path, and sites that do not serve /admin, /repo or /data protected content have less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000745,"input_tokens":4751,"output_tokens":539,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-68548':16A,19A '/admin':34B,90C,155C '/admin/secret.lua':51B,124C '/data':92C,158C '/repo':91C,156C '1.17.10':78C,187C 'accept':138C 'access':12A 'activ':175C 'admin':9A 'admin/secret.lua':146C 'algernon':1A,20B,28B,63C,79C 'alway':117C 'apfs/hfs':119C 'author':84C,159C 'boundari':160C 'branch':139C 'bypass':8A,152C 'case':5A,36B,43B,95C,112C 'case-chang':4A 'case-insensit':111C 'case-sensit':35B,94C 'chang':6A 'check':13A,29B,54B,130C 'configur':179C 'contain':69C 'content':170C 'cve':14A,17A 'data':11A 'default':120C,178C 'disk':144C 'enabl':161C 'evad':125C 'everi':126C 'exact':100C 'execut':167C 'fall':131C 'file':60B,166C 'filesystem':40B,109C,114C 'gate':85C 'go':21B,72C 'host':26B 'ignor':42B 'insensit':113C 'issu':181C 'later':105C 'like':33B 'log':62B 'lookup':41B 'lua':165C 'maco':22B,47B,118C 'match':86C 'ntfs':116C 'patch':184C 'permiss':172C 'prefix':32B,83C,89C,129C,137C 'prior':75C 'protect':30B,59B,88C,128C,169C 'protected-prefix':127C 'public':136C 'public-prefix':135C 'pure':71C 'pure-go':70C 'raw':102C 'read':56B,162C 'req.url.path':103C 'request':49B,122C 'resolv':106C,142C 'result':148C 'run':58B 'runtim':23B 'self':25B,68C 'self-contain':67C 'self-host':24B 'sensit':37B,96C 'server':3A,74C 'skip':52B 'small':66C 'strings.hasprefix':97C 'system':173C 'unauthent':151C 'url':7A,31B,82C 'url-prefix':81C 'version':77C,186C 'web':2A,73C 'window':27B,45B,115C 'without':61B","nicknames":[],"mitigations":[],"who_affected":"Algernon servers before 1.17.10 running on case-insensitive filesystems (Windows NTFS, macOS APFS or HFS+ by default) with the permission system active, which is its default configuration. Linux servers with case-sensitive filesystems are not affected by this path, and sites that do not serve /admin, /repo or /data protected content have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["algernon","critical","go","macos","runtime","selfhosted","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-68548':16A,19A 'access':12A 'admin':9A 'algernon':1A 'bypass':8A 'case':5A 'case-chang':4A 'chang':6A 'check':13A 'cve':14A,17A 'data':11A 'server':3A 'url':7A 'web':2A","search_b":"'/admin':34B '/admin/secret.lua':51B 'algernon':20B,28B 'case':36B,43B 'case-sensit':35B 'check':29B,54B 'file':60B 'filesystem':40B 'go':21B 'host':26B 'ignor':42B 'like':33B 'log':62B 'lookup':41B 'maco':22B,47B 'prefix':32B 'protect':30B,59B 'read':56B 'request':49B 'run':58B 'runtim':23B 'self':25B 'self-host':24B 'sensit':37B 'skip':52B 'url':31B 'window':27B,45B 'without':61B","search_c":"'/admin':90C,155C '/admin/secret.lua':124C '/data':92C,158C '/repo':91C,156C '1.17.10':78C,187C 'accept':138C 'activ':175C 'admin/secret.lua':146C 'algernon':63C,79C 'alway':117C 'apfs/hfs':119C 'author':84C,159C 'boundari':160C 'branch':139C 'bypass':152C 'case':95C,112C 'case-insensit':111C 'case-sensit':94C 'check':130C 'configur':179C 'contain':69C 'content':170C 'default':120C,178C 'disk':144C 'enabl':161C 'evad':125C 'everi':126C 'exact':100C 'execut':167C 'fall':131C 'file':166C 'filesystem':109C,114C 'gate':85C 'go':72C 'insensit':113C 'issu':181C 'later':105C 'lua':165C 'maco':118C 'match':86C 'ntfs':116C 'patch':184C 'permiss':172C 'prefix':83C,89C,129C,137C 'prior':75C 'protect':88C,128C,169C 'protected-prefix':127C 'public':136C 'public-prefix':135C 'pure':71C 'pure-go':70C 'raw':102C 'read':162C 'req.url.path':103C 'request':122C 'resolv':106C,142C 'result':148C 'self':68C 'self-contain':67C 'sensit':96C 'server':74C 'small':66C 'strings.hasprefix':97C 'system':173C 'unauthent':151C 'url':82C 'url-prefix':81C 'version':77C,186C 'web':73C 'window':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T23:47:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68548","severity":null,"published_at":"2026-11-12T20:18:51+00:00","modified_at":"2026-11-12T20:18:51+00:00","first_seen_at":"2026-11-12T20:40:27+00:00","fetched_at":"2026-11-12T20:40:27+00:00","note":null}],"documents":[{"id":138289,"url":"https://github.com/xyproto/algernon/releases/tag/v1.17.10","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":138290,"url":"https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T23:47:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}