CVE-2026-62314

MediumCVSS 5.8

Published: 15/07/2026(UTC)Updated: 12/08/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A vulnerability in Anubis Web AI Firewall Utility from version 1.22.0 to 1.26.0-pre1 allows an attacker to bypass the Anubis challenge by manipulating the X-Original-URI header. The PathChecker.Check() function trusted the client-controlled header before matching r.URL.Path, enabling the use of ALLOW rules for patterns like ^/\.well-known/.*$.

Risk Assessment

An attacker can bypass the bot protection mechanism, gaining unauthorized access to protected upstream resources, increasing the risk of data scraping and DDoS attacks.

Recommendation

Immediately update Anubis to version 1.26.0-pre1 or later, which includes a fix that removes trust in the X-Original-URI header.

Other vulnerabilities in Anubis

CVE-2025-64716Medium
Anubis, a Web AI Firewall Utility, prior to version 1.23.0 did not validate the redirect URL when using subrequest authentication, allowing redirection to any URL scheme. While most modern browsers block redirects to `javascript:` URLs, it could still trigger dangerous behavior in some cases. The issue is fixed in version 1.23.0.

Original NVD description (English source)

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS