go-chi up to 5.4.x Middleware middleware.SupressNotFound improper authentication

Summaryinfo

A vulnerability was found in go-chi chi up to 5.4.x. It has been classified as problematic. The affected element is the function middleware.SupressNotFound of the component Middleware. Performing a manipulation results in improper authentication. This vulnerability is identified as CVE-2026-118681. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in go-chi chi up to 5.4.x. It has been classified as problematic. This affects the function middleware.SupressNotFound of the component Middleware. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality. The summary by CVE is:

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-118681 since 10/28/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 373448 (Linux Distros Unpatched Vulnerability : CVE-2026-118681), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.5.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (373448). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• go-chi

Name

• chi

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4

Website

• Product: https://github.com/go-chi/chi/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion