CVE-2026-118681
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data.
Risk Assessment
Unauthorized retrieval of tenant-scoped data is possible by bypassing authentication. This breaks tenant isolation and data confidentiality in applications using go-chi.
Recommendation
Update the go-chi chi library to version 5.5.0 or later. Review mounted router and authentication middleware configurations for potential exposure.
Other vulnerabilities in go-chi chi
See all- CVE-2026-72817Medium
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.
- CVE-2026-72816Medium
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.
- CVE-2026-72815Medium
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.
- CVE-2025-69725Medium
An Open Redirect vulnerability in the RedirectSlashes function of go-chi/chi version 5.2.2 and later allows remote attackers to redirect victims to malicious websites using the legitimate website domain.
Original NVD description (English source)
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS