CVE-2026-91143

Deferred Deferred - Pending Action

GoProxy HTTP Proxy Authentication Bypass via CONNECT

Publication date: 2026-09-14

Last updated on: 2026-09-23

Assigner: VulnCheck

Description

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-23

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-03

NVD

CVE-2026-91143

EUVD

EUVD-2026-78166

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

goproxy through version 15.3 does not enforce HTTP proxy basic authentication for CONNECT tunnel requests. This allows unauthenticated users to bypass credential requirements by issuing CONNECT requests, which establish tunnels through the proxy without providing valid credentials. Attackers can then relay arbitrary TCP traffic and access restricted destinations through the proxy.

Detection Guidance

Check proxy logs for CONNECT requests without prior authentication attempts. Monitor network traffic for unauthorized TCP tunnels through the proxy. Use tools like tcpdump or Wireshark to inspect proxy traffic for unauthenticated CONNECT requests.

Impact Analysis

This vulnerability enables unauthorized users to bypass authentication and use your proxy server to access restricted networks or services. Attackers could exploit this to relay malicious traffic, exfiltrate data, or access internal systems, potentially leading to data breaches or unauthorized network access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using goproxy without proper authentication may fail compliance audits due to inadequate access controls and logging gaps.

Mitigation Strategies

Upgrade goproxy to version 15.3 or later to apply authentication to CONNECT requests. Configure proxy rules to reject CONNECT requests without prior authentication. Restrict proxy access to trusted networks only.

Hi! I’m here to help you understand CVE-2026-91143. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70