CVE-2026-105299 Cloudflare CVE debrief

Who should care

Defenders and administrators of systems using Pingora, especially those with chained deployments involving HTTP/1 intermediaries, should assess their configurations for exposure and prioritize remediation.

Why it matters

CVE-2026-105299 is significant for defenders because it can lead to ACL bypass in specific Pingora deployments, particularly those using HTTP/1 intermediaries. The vulnerability allows client-nominated Connection headers to be forwarded to HTTP/1 upstreams, potentially enabling unauthorized access. Defenders should prioritize assessment and remediation of Pingora configurations, especially in affected versions before 0.9.0.

• Potential ACL bypass in specific chained deployments.
• Exposure of sensitive headers to intermediaries.
• Need for verification of Pingora versions and configurations.
• Possible impact on IP-based authorization mechanisms.

Technical summary

Pingora versions before 0.9.0 forward client-nominated Connection headers to HTTP/1 upstreams without removing them, as required by RFC 9110 Section 7.6.1. This behavior can lead to ACL bypass in specific chained deployments where an HTTP/1 intermediary processes Connection nominations and the origin trusts headers added by that intermediary. The vulnerability is particularly relevant for configurations where an HTTP/1 intermediary is used between Pingora and the origin, and defenders should prioritize assessment and remediation of Pingora configurations, especially in affected versions before 0.9.0.

Defensive priority

Defenders should prioritize assessment and remediation of Pingora configurations, especially in chained deployments with HTTP/1 intermediaries.

Recommended defensive actions

• Assess Pingora configurations for exposure, especially in chained deployments with HTTP/1 intermediaries.
• Verify if Pingora versions in use are before 0.9.0 and prioritize upgrading to 0.9.0 or later.
• Review and adjust ACL configurations to account for potential header manipulation.
• Monitor for unusual activity that could indicate exploitation attempts.
• Perform an inventory of assets using Pingora to identify potential exposure.
• Review change management processes to ensure timely application of security updates.
• Track and verify the remediation status of exposed systems.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, specific details about exploitation or victimized systems are not provided. The issue is particularly relevant for configurations where an HTTP/1 intermediary is used between Pingora and the origin. Defenders should verify Pingora versions and configurations, especially in chained deployments with HTTP/1 intermediaries. The CVE Program record and NVD detail page offer additional context on the vulnerability and its severity

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.