CVE-2026-54650 in openhole
Summary
by MITRE • 07/29/2026
openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The openhole vulnerability represents a critical path traversal flaw that emerged from improper URL handling within the server component of the software. This vulnerability existed in versions 0.1.1 and earlier, specifically within the internal/server/public_proxy.go file where the application failed to properly sanitize incoming URL paths during proxy forwarding operations. The flaw stemmed from the application's decision to forward r.URL.Path directly instead of utilizing the more secure r.URL.EscapedPath() method which would have preserved the original encoded request target.
The technical implementation of this vulnerability allowed malicious actors to exploit the lack of proper path sanitization by crafting specially formatted requests containing percent-encoded characters. Specifically, the vulnerability enabled attackers to inject %2e sequences representing dot segments and %2f sequences representing forward slashes into the URL path. When these encoded sequences reached the tunneled local services, they were decoded and interpreted as ../ and / respectively, creating an opportunity for directory traversal attacks. This flaw essentially allowed remote attackers to bypass normal access controls and potentially access files or directories that should have remained protected within the local service environment.
The operational impact of this vulnerability extends beyond simple path traversal as it fundamentally compromised the security boundaries established by the proxy service. Attackers could leverage this weakness to access localhost services that were intended to remain isolated from external network exposure, effectively turning the proxy into an unauthorized access point for internal resources. This represents a significant failure in the principle of least privilege and could potentially lead to data exfiltration, service disruption, or further exploitation within the internal network environment.
This vulnerability aligns with CWE-22 Path Traversal and follows patterns commonly associated with improper input validation in web applications. From an attack perspective, it maps to techniques described in the ATT&CK framework under T1071.004 Application Layer Protocol: Web Protocols where adversaries exploit weaknesses in web application handling of URL paths. The fix implemented in version 0.1.2 demonstrates proper remediation through the adoption of r.URL.EscapedPath() which preserves the original encoded URL structure and prevents the injection of malicious path traversal sequences into forwarded requests.
Security practitioners should understand that this vulnerability highlights the critical importance of proper URL sanitization and encoding handling in proxy and tunneling applications. The fix serves as a reminder that seemingly simple proxy operations can introduce significant security risks when proper input validation is not implemented. Organizations using openhole should immediately upgrade to version 0.1.2 or later and conduct thorough security assessments of any other proxy services within their environment that may exhibit similar vulnerabilities in URL handling practices.
The vulnerability also demonstrates how modern web applications must consider the full spectrum of potential attack vectors, including those that exploit the fundamental assumptions about how URL paths should be processed and forwarded between network layers. Proper implementation of URL encoding and decoding functions becomes essential when building systems that operate as intermediaries between external networks and internal services, particularly in scenarios where access control and network segmentation are critical security requirements.