CVE-2026-91143 in goproxy
Summary
by MITRE • 09/15/2026
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability in GoProxy versions 15.3 and earlier represents a critical authentication bypass flaw within the HTTP proxy implementation, specifically affecting the handling of HTTPS tunneling requests via the CONNECT method. In standard web proxy operations, clients typically authenticate using Basic or Digest authentication schemes before being granted access to forward traffic through the proxy server. This mechanism ensures that only authorized users can utilize the proxy's resources and adhere to organizational security policies regarding internet access control. However, in this specific implementation, the logic responsible for validating credentials is not consistently applied across all request types. While standard HTTP GET or POST requests are correctly intercepted and checked against configured user credentials, the CONNECT method, which is used by clients to establish a TCP/IP tunnel through the proxy for secure HTTPS connections, fails to trigger the same authentication checks.
This technical flaw allows an unauthenticated client to issue a CONNECT request directly to the GoProxy instance without providing any valid username or password. Once the server accepts this connection and establishes the tunnel, it begins relaying arbitrary TCP traffic between the attacker's machine and the target destination on behalf of the proxy user. This effectively neutralizes the access control mechanisms intended by the system administrator, as the authentication gate is completely circumvented for encrypted connections. The root cause lies in a logical inconsistency within the request handling pipeline where the authentication middleware or handler chain does not include CONNECT requests in its scope of protected resources, likely due to an oversight in routing rules or filter configurations that prioritize tunnel establishment speed over security validation.
The operational impact of this vulnerability is severe, as it enables unauthorized access to internal networks and restricted external services that are normally shielded by the proxy's authentication requirements. An attacker can exploit this flaw to conduct reconnaissance activities, such as port scanning or service enumeration against internal hosts that would otherwise be inaccessible from untrusted networks. Furthermore, because HTTPS traffic appears encrypted and opaque to intermediate security devices like Intrusion Detection Systems (IDS) or Web Application Firewalls (WAFs), the malicious activity may go undetected for extended periods. The attacker can also use this tunnel to exfiltrate sensitive data or launch attacks against backend services that trust connections coming from the proxy's IP address, thereby leveraging the compromised infrastructure as a pivot point for further network penetration.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, specifically highlighting the failure to verify identity before granting access to protected resources. It also maps closely to MITRE ATT&CK technique T1090, Proxy, where adversaries use proxy servers to hide their traffic and evade detection by security monitoring tools. The ability to bypass authentication controls allows attackers to operate with a higher degree of anonymity while maintaining the appearance of legitimate user activity within network logs. This misconfiguration undermines the principle of least privilege and compromises the integrity of access control policies enforced at the network perimeter.
To mitigate this risk, organizations running GoProxy versions 15.3 or earlier must upgrade immediately to the latest patched version where the authentication logic has been corrected to apply uniformly across all HTTP methods, including CONNECT tunnel requests. In environments where an immediate patch is not feasible, administrators should implement a reverse proxy in front of GoProxy that enforces strict access control lists and requires valid credentials before forwarding any traffic, effectively closing the gap left by the application-level flaw. Additionally, network segmentation strategies should be reviewed to ensure that even if authentication is bypassed, lateral movement within critical internal networks remains restricted through additional firewall rules or zero-trust architecture principles. Regular auditing of proxy configurations against industry standards such as NIST SP 800-41 guidelines for firewalls and proxies can help identify similar logical inconsistencies in other network security appliances.