Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck
CVE-2026-118681go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware
Low 3.7
In plain English
A low-severity authentication bypass in chi from go-chi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-go-chi-chi | no fix listed | DEBIAN-CVE-2026-118681 |
| Debian:13 | golang-github-go-chi-chi | no fix listed | DEBIAN-CVE-2026-118681 |
| Debian:14 | golang-github-go-chi-chi | no fix listed | DEBIAN-CVE-2026-118681 |
| Ubuntu:22.04:LTS | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2026-118681 |
| Ubuntu:24.04:LTS | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2026-118681 |
| Ubuntu:26.04:LTS | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2026-118681 |
| Ubuntu:26.10 | golang-github-go-chi-chi | no fix listed | UBUNTU-CVE-2026-118681 |
Affected products (as reported)
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-rqrp-8cg2-5958) vendor-advisory
- VulnCheck Advisory: go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware third-party-advisory