CVE-2026-0650
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials.
Risk Assessment
Unauthorized access may allow modification of feature flags and export of sensitive data, posing a serious risk to system integrity and confidentiality.
Recommendation
Immediately upgrade OpenFlagr to a version later than 1.1.18 that includes a fix for this vulnerability. Until the update is applied, restrict API access using additional access control mechanisms.
Original NVD description (English source)
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.