CVE-2026-91143 snail007 CVE debrief

Who should care

Defenders responsible for proxy configurations and authentication measures should assess exposure and apply necessary updates to prevent exploitation of CVE-2026-91143. This includes verifying goproxy versions, reviewing proxy configurations, and monitoring for unauthorized access attempts. Additionally, operators, platforms, vulnerability-management teams, and security teams should be aware of the potential impact and take necessary actions to prevent or

Why it matters

CVE-2026-91143 allows unauthenticated clients to bypass credential requirements for CONNECT tunnel requests in goproxy through 15.3, enabling arbitrary TCP traffic relay and access to restricted destinations.

• Verify authentication measures for proxy configurations
• Assess exposure of goproxy versions in use
• Update goproxy configurations to require authentication for CONNECT requests
• Monitor for unauthorized access attempts

Technical summary

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. This vulnerability enables arbitrary TCP traffic relay and access to restricted destinations. Defenders should prioritize verifying goproxy versions and applying authentication measures to prevent exploitation. The issue highlights the importance of reviewing proxy configurations and assessing exposure to prevent unauthorized access attempts. Affected product deployments should be identified, and owners assigned for follow-up.

Defensive priority

Defenders should prioritize verifying goproxy versions and applying authentication measures.

Recommended defensive actions

• Verify goproxy versions in use and assess exposure to CVE-2026-91143
• Apply authentication measures for CONNECT tunnel requests
• Review and update goproxy configurations to require authentication
• Monitor for unauthorized access attempts and verify proxy configurations
• Assess and update compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in goproxy through 15.3. Evidence from these sources indicates that goproxy fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, which can be exploited by unauthenticated clients. Defenders should verify goproxy versions and apply authentication measures to prevent unauthorized access. Additional verification tasks include reviewing proxy configurations, assessing exposure, and monitoring for unauthorized access attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.