https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:26:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-351620 EUVD-2026-351620 https://cve.radiocsirt.org/vuln/euvd-2026-351620 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62314 <p>Anubis is a Web AI Firewall Utility that challenges users&#39; connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.</p> <p>Anubis is a Web AI Firewall Utility that challenges users&#39; connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-62314 https://cve.radiocsirt.org/vuln/ghsa-6wcg-mqvh-fcvg <p><strong>Affected:</strong> Go: github.com/TecharoHQ/anubis</p> <p>Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved. Affected versions: v1.22.0 through v1.25.0 (introduced in commit d1d631a, PR #1015)</p> <p>The root cause is in `lib/policy/checker.go`, `PathChecker.Check()`: ```go func (pc *PathChecker) Check(r *http.Request) (bool, error) { originalUrl := r.Header.Get(&#34;X-Original-URI&#34;) if originalUrl != &#34;&#34; { if pc.regexp.MatchString(originalUrl) { return true, nil } } if pc.regexp.MatchString(r.URL.Path) { return true, nil } return false, nil } ```</p> <p>The header value comes directly from the client request. The middleware chain never strips it. In reverse proxy mode an attacker fully controls it. The default policy imports `data/common/keep-internet-working.yaml`, which contains path-only ALLOW rules with no other conditions:</p> <p>```yaml - name: well-known path_regex: ^/\.well-known/.*$ action: ALLOW ```</p> <p>When `X-Original-URI` matches one of those regexes, the rule fires as ALLOW and the request is forwarded upstream without any challenge or JWT check.</p> <p># Proof of concept</p> <p>Normal request, gets challenged: ``` curl -s https://anubis.techaro.lol/ | grep -o &#34;&lt;title&gt;.*&lt;/title&gt;&#34; ```</p> <p>Bypass, gets upstream content: ``` curl -s -H &#34;X-Original-URI: /.well-known/x&#34; https://anubis.techaro.lol/ | grep -o &#34;&lt;title&gt;.*&lt;/title&gt;&#34; ```</p> <p>The first command returns the Anubis challenge page title. The second retu…</p> <p><strong>Affected:</strong> Go: github.com/TecharoHQ/anubis</p> <p>Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved. Affected versions: v1.22.0 through v1.25.0 (introduced in commit d1d631a, PR #1015)</p> <p>The root cause is in `lib/policy/checker.go`, `PathChecker.Check()`: ```go func (pc *PathChecker) Check(r *http.Request) (bool, error) { originalUrl := r.Header.Get(&#34;X-Original-URI&#34;) if originalUrl != &#34;&#34; { if pc.regexp.MatchString(originalUrl) { return true, nil } } if pc.regexp.MatchString(r.URL.Path) { return true, nil } return false, nil } ```</p> <p>The header value comes directly from the client request. The middleware chain never strips it. In reverse proxy mode an attacker fully controls it. The default policy imports `data/common/keep-internet-working.yaml`, which contains path-only ALLOW rules with no other conditions:</p> <p>```yaml - name: well-known path_regex: ^/\.well-known/.*$ action: ALLOW ```</p> <p>When `X-Original-URI` matches one of those regexes, the rule fires as ALLOW and the request is forwarded upstream without any challenge or JWT check.</p> <p># Proof of concept</p> <p>Normal request, gets challenged: ``` curl -s https://anubis.techaro.lol/ | grep -o &#34;&lt;title&gt;.*&lt;/title&gt;&#34; ```</p> <p>Bypass, gets upstream content: ``` curl -s -H &#34;X-Original-URI: /.well-known/x&#34; https://anubis.techaro.lol/ | grep -o &#34;&lt;title&gt;.*&lt;/title&gt;&#34; ```</p> <p>The first command returns the Anubis challenge page title. The second retu…</p> https://cve.radiocsirt.org/vuln/ghsa-6wcg-mqvh-fcvg