CVE-2026-110619
Deferred Deferred - Pending Action

Unauthenticated Access to Debug Endpoints in frp

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-110619
EUVD
EUVD-2026-101247

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fatedier frp 0.41.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-110619 is a missing authentication vulnerability in frp versions 0.41.0 through 0.71.1. It allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain sensitive information like cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.

Detection Guidance

Check if frp is running with pprof enabled by inspecting the configuration file for the pprofEnable setting. Use curl to query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners. Example: curl http://<frp-server>:<port>/debug/pprof/ or curl http://<frp-server>:<port>/debug/pprof/cmdline.

Impact Analysis

This vulnerability allows attackers to access sensitive runtime information and trigger profiling, potentially leading to low-impact confidentiality and availability issues. Unauthorized access to diagnostic data or resource exhaustion from repeated profiling requests may occur.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive runtime information through unauthenticated access to pprof debug endpoints. Unauthorized access to process details, goroutine stacks, or profiling data may violate data confidentiality requirements under these regulations.

Mitigation Strategies

Disable pprof by setting pprofEnable to false in the frp configuration. Ensure Basic Authentication is properly configured for all web listeners. Restrict access to frp admin listeners to trusted networks only. Consider isolating pprof endpoints on a loopback-only listener.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart