CVE-2026-118681 in chi
Summary
by MITRE • 10/28/2026
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in go-chi versions prior to 5.5.0 represents a critical authentication bypass within its routing middleware architecture. Specifically, the flaw resides in the SupressNotFound middleware component, which is designed to handle cases where no route matches the incoming request by suppressing standard not found errors. However, due to an implementation error involving how the live routing context interacts with mounted routers, this middleware inadvertently preserves parameter values and child suffixes from a nested or mounted router when dispatching against an outer parent router. This behavior creates a significant security gap that allows unauthenticated attackers to bypass intended access controls by exploiting the mismatch between route matching logic and authentication enforcement mechanisms.
From a technical perspective, the root cause lies in how go-chi manages routing contexts during request processing. When a request is made to a path that matches a mounted sub-router but does not fully match any specific handler within that mount, SupressNotFound intervenes. Instead of discarding the partial route information or correctly resetting the context, it retains parameters and suffixes associated with the inner router structure. These retained elements are then passed up to the outer routing layer for further evaluation against public routes. If an attacker crafts a request where the path partially matches a protected mounted endpoint but ends in a way that also satisfies a pattern defined on the parent router without authentication requirements, the system may proceed as if the user is authenticated under the inner context while actually executing logic intended for unauthenticated access at the outer level.
This architectural flaw has severe operational implications for applications relying on tenant-scoped data isolation or role-based access control through middleware chains. Attackers can exploit this by submitting requests that target a mounted route requiring authentication but appending additional path segments that align with an unprotected public endpoint defined in the parent router hierarchy. Because the outer handler trusts parameters inherited from the mount context, it may inadvertently expose sensitive tenant-specific information to unauthorized users. This effectively neutralizes the security boundary established by middleware layers designed to enforce identity verification before data retrieval occurs.
In terms of industry classification standards, this vulnerability aligns with CWE-287 Improper Authentication and CWE-436 Interpretation Conflict. The issue stems from a conflict in how different levels of the routing hierarchy interpret route parameters and context state during error suppression scenarios. Furthermore, within the MITRE ATT&CK framework, this technique corresponds to T1078 Valid Accounts or more broadly to privilege escalation via misconfigured access control mechanisms where authentication checks are bypassed through path manipulation rather than credential compromise. It exemplifies how complex middleware chaining can introduce subtle logic errors that undermine security postures if context state is not strictly managed across hierarchical boundaries.
To mitigate this vulnerability, organizations must upgrade the go-chi library to version 5.5.0 or later where these routing context handling issues have been addressed by developers. Until an update is applied, defensive coding practices should be employed such as explicitly validating authentication status within each handler rather than relying solely on middleware placement order assumptions. Additionally, implementing strict input validation and ensuring that mounted routers do not leak state into parent contexts during partial matches can reduce exposure. Security teams should also audit existing applications for similar patterns where route parameters are assumed to remain consistent across different layers of the request processing pipeline without explicit re-verification at each stage.