UBUNTU-CVE-2026-118681: Medium severity vulnerability
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go-chi chito a version that resolves this vulnerability.Fixed in 5.5.0
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using go-chi versions before 5.5.0 may be exposed if they mount a router protected by authentication middleware and also have an outer public route whose suffix can match requests beneath that mount. Exposure additionally depends on the outer handler trusting the mount parameter retained from routing.
What does an attacker need to exploit this issue?
An attacker does not need credentials or user interaction, but must be able to make network requests. Exploitation requires a crafted mounted-path request whose suffix matches an outer public route.
Are all applications using an affected go-chi version vulnerable by default?
No. The described bypass depends on a specific routing arrangement: a mounted authenticated router, a matching outer public route, and an outer handler that relies on the retained mount parameter. The available information does not establish that every default application configuration has this arrangement.
How can I assess whether an application is affected?
Review routes that use middleware.SupressNotFound and identify authenticated mounted routers with path suffixes that overlap public outer routes. Test whether an unauthenticated request under a mounted path is dispatched to an outer public handler while retaining a tenant or mount parameter, and whether that handler can return tenant-scoped data.