CVE-2026-34206: Captcha Protect XSS Vulnerability

CVE-2026-34206 Overview

CVE-2026-34206 is a reflected cross-site scripting (XSS) vulnerability in the Captcha Protect middleware for Traefik (github.com/libops/captcha-protect). This middleware is designed to add anti-bot challenge capabilities to individual IPs within a subnet when traffic spikes are detected. Prior to version 1.12.2, the challenge page accepted a client-supplied destination value and rendered it into HTML using Go's text/template package. Because text/template does not perform contextual HTML escaping, an attacker could supply a crafted destination value that breaks out of the hidden input attribute and injects arbitrary script into the challenge page.

Critical Impact

Attackers can inject malicious JavaScript into the challenge page, potentially stealing session cookies, hijacking user sessions, or performing actions on behalf of authenticated users interacting with the captcha challenge.

Affected Products

• Captcha Protect (github.com/libops/captcha-protect) versions prior to 1.12.2
• Traefik deployments using the affected Captcha Protect middleware
• Web applications protected by vulnerable versions of the middleware

Discovery Timeline

• 2026-03-31 - CVE-2026-34206 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34206

Vulnerability Analysis

The vulnerability exists in the challenge page rendering logic of Captcha Protect. When a user is presented with a captcha challenge, the middleware accepts a destination parameter that specifies where the user should be redirected after successfully completing the challenge. This value is rendered directly into the HTML response using Go's text/template package.

The critical issue is that text/template is designed for plain text output and does not perform HTML-aware contextual escaping. This means that special HTML characters like <, >, ", and ' are not automatically escaped when the template is rendered. An attacker can exploit this by crafting a malicious destination parameter that contains JavaScript code, which then gets injected directly into the challenge page's HTML.

Root Cause

The root cause is the use of Go's text/template package instead of html/template for rendering user-controlled input into HTML content. While text/template is appropriate for generating plain text output, html/template provides automatic contextual escaping that prevents XSS attacks by encoding special characters based on where they appear in the HTML document.

Attack Vector

The attack is network-based and requires user interaction. An attacker can craft a malicious URL containing a specially crafted destination parameter. When a victim clicks on this link and encounters the captcha challenge page, the injected JavaScript executes in the victim's browser context. This could allow the attacker to steal cookies, capture form data, redirect users to phishing sites, or perform other malicious actions within the security context of the vulnerable application.

// Patch showing the fix - importing html/template
 	"context"
 	"encoding/json"
 	"fmt"
+	htemplate "html/template"
 	"log/slog"
 	"math/rand"
 	"net"

Source: GitHub Commit eef6211

The fix imports Go's html/template package (aliased as htemplate) to replace the use of text/template for HTML rendering. This ensures that user-supplied values like the destination parameter are properly escaped according to their HTML context, preventing script injection.

Detection Methods for CVE-2026-34206

Indicators of Compromise

• Unusual URL parameters in captcha challenge requests containing HTML tags or JavaScript event handlers (e.g., "><script>, onmouseover=, onerror=)
• Web application firewall logs showing blocked XSS patterns targeting the captcha challenge endpoint
• Browser console errors indicating blocked inline script execution (if CSP is configured)

Detection Strategies

• Monitor web server logs for requests to captcha challenge endpoints with suspicious destination parameter values containing HTML metacharacters
• Implement content security policy (CSP) headers to detect and block unauthorized inline script execution
• Deploy web application firewall (WAF) rules to identify common XSS payload patterns in request parameters
• Review application logs for anomalous redirect patterns following captcha completion

Monitoring Recommendations

• Enable verbose logging on Traefik middleware to capture full request details including query parameters
• Configure alerts for requests matching known XSS payload signatures targeting captcha endpoints
• Monitor for unusual spikes in captcha challenge page access from single IP addresses which may indicate exploitation attempts

How to Mitigate CVE-2026-34206

Immediate Actions Required

• Upgrade Captcha Protect to version 1.12.2 or later immediately
• If immediate upgrade is not possible, implement a web application firewall rule to sanitize the destination parameter
• Review web server logs for any evidence of exploitation attempts
• Consider implementing Content Security Policy (CSP) headers as an additional defense layer

Patch Information

The vulnerability has been patched in Captcha Protect version 1.12.2. The fix replaces the use of text/template with html/template for rendering the challenge page, ensuring proper HTML contextual escaping of user-supplied input.

For detailed patch information, see:

• GitHub Release v1.12.2
• GitHub Security Advisory GHSA-ph62-4j5g-2q4r

Workarounds

• Deploy a reverse proxy or WAF in front of the application to sanitize or block requests containing HTML special characters in the destination parameter
• Implement strict input validation at the application layer to reject destination values containing <, >, ", ', or other HTML metacharacters
• Configure Content Security Policy headers to restrict inline script execution (script-src 'self')

# Example Traefik middleware configuration with CSP headers
# Add to your Traefik dynamic configuration
http:
  middlewares:
    security-headers:
      headers:
        contentSecurityPolicy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
        xssProtection: "1; mode=block"
        contentTypeNosniff: "nosniff"