CVE-2026-118681: go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go-chi/chito a version that resolves this vulnerability.Fixed in 5.5.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using go-chi chi before 5.5.0 are exposed only where middleware.SupressNotFound is used with a mounted router that applies authentication middleware, and an outer public route can be matched by the mounted path suffix. Exposure further depends on an outer handler trusting the retained mount parameter to retrieve tenant-scoped data.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They must be able to send a request to a mounted path whose suffix matches an outer public route, causing dispatch to the outer route while retaining the mounted router's parameter and child suffix.
Are default installations affected?
The available information does not establish that a default configuration is affected. Exploitation depends on a specific routing and middleware arrangement involving SupressNotFound, a mounted authenticated router, and a matching public outer route.
How can I assess whether my application is affected?
Review routes using middleware.SupressNotFound and identify mounted routers protected by authentication middleware. Check whether requests under those mounts can have suffixes that match outer public routes, and whether those outer handlers use retained mount parameters when accessing tenant-scoped data.