CVE-2026-68548: Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate
Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Algernonto a version that resolves this vulnerability.Fixed in 1.17.10
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Algernon versions before 1.17.10 are exposed when running on a case-insensitive filesystem. This includes Windows NTFS and default macOS APFS or HFS+ configurations; the permission system is active by default.
What does an attacker need to exploit the issue?
An attacker only needs network access to the Algernon server and does not need credentials or user interaction. They can vary the capitalization of a protected path, such as requesting /Admin/secret.lua instead of /admin/secret.lua.
What access can exploitation provide?
The bypass can expose content under the protected /admin, /repo, and /data paths. Protected Lua files may also be executed, while the vulnerability's stated impact includes high confidentiality and integrity impact and limited availability impact.
How can I determine whether a server may already be affected?
Check whether Algernon is older than 1.17.10 and is hosted on a case-insensitive filesystem. Requests to protected paths with capitalization differing from the configured lowercase prefixes, such as /Admin, /Repo, or /Data, indicate the relevant bypass condition.
What should be done to remediate the issue?
Upgrade Algernon to version 1.17.10, which contains the patch. The provided information does not identify an alternative mitigation for systems that cannot be upgraded immediately.