---
id: "CVE-2026-68548"
page: "https://infrastack.ai/live/CVE-2026-68548"
kind: "vulnerability"
aliases: ["CVE-2026-68548"]
title: "Algernon web server: case-changed URLs bypass admin and data access checks"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["algernon", "go", "macos", "runtime", "self-hosted", "windows"]
not_affected_if: ["case-sensitive-filesystem", "no-protected-content", "version-1.17.10-or-later"]
published_at: "2026-11-12T20:18:51+00:00"
first_seen_at: "2026-11-12T20:40:27+00:00"
updated_at: "2026-11-12T20:41:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68548", "first_seen_at": "2026-11-12T20:40:27+00:00"}]
exploit_sources: []
---

# Algernon web server: case-changed URLs bypass admin and data access checks

Link for people: https://infrastack.ai/live/CVE-2026-68548 (this .md is for agents)

Algernon checks protected URL prefixes like /admin case-sensitively, but the filesystem lookup ignores case on Windows and macOS. A request for /Admin/secret.lua skips the check and reads or runs protected files without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `algernon --version` or the version in the project's go.mod, below `1.17.10` means affected
- Check whether the server runs on Windows or macOS, where the bypass applies

## Fix

- Algernon: `1.17.10`

## Timeline

- 2026-11-12T20:40:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68548

## Documents

- [advisory] Vendor advisory: github.com https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx
- [fix] Release notes: github.com https://github.com/xyproto/algernon/releases/tag/v1.17.10

## From the sources

Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_