CVE-2026-110619 fatedier CVE debrief

Who should care

Defenders responsible for frp deployments, especially those using versions 0.41.0 through 0.71.1, should assess the security of their deployments and verify exposure to this vulnerability.

Why it matters

CVE-2026-110619 is a medium-severity vulnerability in frp versions 0.41.0 through 0.71.1 that allows unauthenticated remote attackers to access pprof debug endpoints, potentially providing valuable intelligence to attackers. Defenders should prioritize verifying exposure and assessing the security of their deployments.

• Unauthenticated access to sensitive debug information
• Potential for attackers to gather intelligence on system internals
• Risk of attackers leveraging debug endpoints for further exploitation
• Need for verification of frp version exposure and deployment security

Technical summary

The frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling. This vulnerability stems from handlers being registered on the root mux outside Basic Authentication. Defenders should prioritize verifying exposure of frp versions 0.41.0 through 0.71.1 and assessing the security of their deployments, especially where unauthenticated access to debug endpoints could provide valuable intelligence to attackers.

Defensive priority

Defenders should prioritize verifying exposure of frp versions 0.41.0 through 0.71.1 and assessing the security of their deployments, especially where unauthenticated access to debug endpoints could provide valuable intelligence to attackers.

Recommended defensive actions

• Verify frp versions 0.41.0 through 0.71.1 are not in use or properly secured.
• Assess the security of frp deployments, especially where unauthenticated access to debug endpoints could provide valuable intelligence to attackers.
• Implement authentication for pprof debug endpoints in frp deployments.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in frp, allowing unauthenticated remote attackers to access pprof debug endpoints. However, the corpus does not establish versions beyond 0.41.0 through 0.71.1, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.