CVE-2026-34475: Varnish Cache Auth Bypass Vulnerability

CVE-2026-34475 Overview

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12 contain a vulnerability in URL handling that can lead to cache poisoning or authentication bypass. The flaw exists in certain unchecked req.url scenarios where URLs with a path of / for HTTP/1.1 are mishandled, allowing attackers to potentially manipulate cached content or circumvent authentication mechanisms.

Critical Impact

This cache poisoning vulnerability could allow attackers to serve malicious content to users or bypass authentication controls, potentially affecting all users of affected Varnish Cache deployments.

Affected Products

• Varnish Cache before 8.0.1
• Varnish Enterprise before 6.0.16r12

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-34475 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-34475

Vulnerability Analysis

This vulnerability (CWE-180: Incorrect Behavior Order: Validate Before Canonicalize) stems from improper URL path handling within Varnish Cache and Varnish Enterprise. The issue manifests when the caching system processes HTTP/1.1 requests containing URLs with a root path (/) in unchecked req.url scenarios. The vulnerability exploits a logic flaw in how the cache validates and processes URL paths before canonicalization.

When exploited, attackers can leverage this behavior to either poison the cache with malicious content that gets served to legitimate users, or bypass authentication mechanisms that rely on URL-based access controls. The network-accessible nature of Varnish deployments, typically serving as reverse proxies, makes this vulnerability particularly concerning for organizations relying on Varnish for content delivery and access control.

Root Cause

The root cause is an incorrect behavior order issue (CWE-180) where URL validation occurs at an improper stage in the request processing pipeline. Specifically, the req.url variable is not properly validated in certain edge cases involving root path URLs in HTTP/1.1 requests. This allows specially crafted requests to bypass expected URL handling logic, leading to cache key confusion or authentication control evasion.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP/1.1 requests with specially formatted URLs targeting the root path (/) to exploit the improper validation sequence. The attack complexity is high due to the specific conditions required for exploitation, including the need for unchecked req.url scenarios in the target configuration.

The exploitation typically involves sending carefully crafted HTTP requests that manipulate how Varnish interprets and caches the URL path, allowing the attacker to either:

1. Poison the cache by associating malicious content with legitimate cache keys
2. Bypass authentication checks that rely on URL path matching

For detailed technical information, refer to the Vinyl Security Advisory VSV00018.

Detection Methods for CVE-2026-34475

Indicators of Compromise

• Unusual HTTP/1.1 requests with malformed or unexpected root path URL patterns in access logs
• Cache hit/miss anomalies where unexpected content is being served for legitimate URLs
• Authentication bypass attempts visible in access control logs with suspicious URL patterns

Detection Strategies

• Monitor Varnish access logs for HTTP/1.1 requests with unusual path handling patterns involving the root path
• Implement anomaly detection for cache behavior, specifically watching for unexpected cache key collisions
• Review VCL configurations for unchecked req.url usage patterns that may be vulnerable
• Deploy web application firewalls (WAF) with rules to detect cache poisoning attempts

Monitoring Recommendations

• Enable verbose logging on Varnish instances to capture detailed request information including full URLs
• Set up alerts for authentication failures that coincide with unusual URL patterns
• Monitor cache hit ratios and investigate sudden changes that could indicate poisoning attempts
• Implement integrity monitoring for cached content where feasible

How to Mitigate CVE-2026-34475

Immediate Actions Required

• Upgrade Varnish Cache to version 8.0.1 or later immediately
• Upgrade Varnish Enterprise to version 6.0.16r12 or later immediately
• Review and audit VCL configurations for unchecked req.url usage
• Consider implementing additional URL validation in VCL as a defense-in-depth measure

Patch Information

Security patches are available in Varnish Cache 8.0.1 and Varnish Enterprise 6.0.16r12. Organizations should prioritize upgrading to these patched versions. For detailed patch information and upgrade instructions, consult the Vinyl Security Advisory VSV00018.

Workarounds

• Implement strict URL validation in VCL configurations to sanitize req.url before processing
• Add explicit checks for root path handling in custom VCL rules
• Consider deploying a WAF in front of Varnish to filter potentially malicious requests
• If authentication bypass is a concern, implement additional backend-level authentication verification

# Example VCL configuration to add URL validation
# Add to your vcl_recv subroutine
sub vcl_recv {
    # Normalize and validate URL paths
    set req.url = std.querysort(req.url);
    
    # Add explicit root path handling
    if (req.url ~ "^/$") {
        # Apply stricter validation for root path requests
        # Customize based on your requirements
    }
}