CVE-2026-91143: goproxy through 15.3 Authentication Bypass via CONNECT
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
goproxyto a version that resolves this vulnerability.Fixed in 15.3Patch goproxy through 15.3 Authentication Bypass via CONNECT - Compensating control
Block or restrict CONNECT tunneling through the authenticated proxy so clients cannot use CONNECT to relay arbitrary TCP traffic or reach restricted destinations without proper authentication.
Event History
Frequently Asked Questions
Which proxy deployments are exposed?
Deployments of goproxy through 15.3 that rely on HTTP proxy basic authentication are exposed for CONNECT tunnel requests. Clients able to reach the proxy can establish tunnels without supplying the expected credentials.
What does an attacker need to exploit this issue?
An attacker needs network access to the proxy's HTTP service and the ability to send a CONNECT request. No credentials or user interaction are required.
What can an unauthenticated attacker do after bypassing authentication?
They can establish a CONNECT tunnel through the proxy and relay arbitrary TCP traffic. This can provide access to destinations that are restricted behind the authenticated proxy.