CVE-2026-88829

Awaiting Analysis Awaiting Analysis - Queue

BusyBox httpd Reverse Proxy Path Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-88829

EUVD

EUVD-2026-100952

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Hardened Images *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability is in BusyBox httpd's reverse proxy feature. When configured to forward requests matching a URL prefix, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a second pipelined request that bypasses path restrictions, allowing access to arbitrary backend paths not intended to be exposed through the proxy.

Detection Guidance

To detect this vulnerability, check if BusyBox httpd is running with reverse proxy rules enabled. Inspect configuration files for P: directives in BusyBox httpd. Monitor network traffic for pipelined HTTP requests targeting backend paths. Use tools like tcpdump or Wireshark to capture and analyze HTTP traffic for unusual request patterns.

Impact Analysis

An attacker could bypass authentication rules and access backend resources without credentials. This includes administrative endpoints and allows invoking arbitrary HTTP methods like DELETE, PUT, and POST. Systems using BusyBox httpd with reverse proxy rules enabled are at risk.

Compliance Impact

This vulnerability allows unauthenticated attackers to bypass access controls and send arbitrary HTTP requests to backend servers, potentially exposing sensitive data. For GDPR, this could lead to unauthorized access to personal data, violating principles of data protection and user consent. Under HIPAA, it may result in unauthorized access to protected health information, compromising confidentiality requirements.

Mitigation Strategies

Remove or disable reverse proxy rules (P: directives) in BusyBox httpd configuration.
Replace BusyBox httpd with a full reverse proxy like nginx or HAProxy.
Recompile BusyBox without the httpd reverse proxy feature if removal is not possible.

Hi! I’m here to help you understand CVE-2026-88829. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70