CVE-2026-91143
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
Risk Assessment
Unauthenticated attackers can use the proxy to relay traffic and access internal resources, potentially leading to network compromise.
Recommendation
Upgrade goproxy to a version later than 15.3 that includes a fix for enforcing authentication for CONNECT.
Other vulnerabilities in goproxy
Original NVD description (English source)
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS