CVE-2026-110619: frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
frp versions 0.41.0 through 0.71.1 are affected where an frps dashboard listener or frpc admin listener is reachable by a remote attacker. The exposed endpoints are under /debug/pprof/.
What can an unauthenticated attacker obtain or do?
An attacker can retrieve process command-line information, goroutine stacks, and heap profiles. They can also trigger CPU profiling through the pprof debug endpoints.
Does enabling Basic Authentication protect these debug endpoints?
No. The pprof handlers are registered on the root mux outside Basic Authentication, so the affected /debug/pprof/ endpoints can be accessed without authentication.
What can be done while patching is unavailable?
Restrict network access to frps dashboard and frpc admin listeners so remote attackers cannot reach their /debug/pprof/ paths. The provided data does not identify another application-level mitigation.