CVE-2026-40885: goshs Information Disclosure Vulnerability

CVE-2026-40885 Overview

CVE-2026-40885 is an Information Leakage vulnerability affecting goshs, a SimpleHTTPServer implementation written in Go. This vulnerability allows unauthenticated attackers to capture file-based ACL credentials through the public collaborator feed when the server is deployed without global basic authentication enabled.

Critical Impact

Attackers can intercept folder-specific basic-auth credentials and replay them to gain unauthorized read, upload, overwrite, and delete access to protected file subtrees.

Affected Products

• goshs versions 2.0.0-beta.4 to 2.0.0-beta.5

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40885 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40885

Vulnerability Analysis

This vulnerability stems from improper handling of authentication credentials in goshs's collaborator feed mechanism. When goshs is deployed without global basic authentication, requests to .goshs-protected folders are logged before authorization checks are enforced. The collaborator websocket then broadcasts raw request headers, including the Authorization header containing basic-auth credentials.

This information exposure flaw (CWE-200) allows an unauthenticated observer to passively monitor the websocket feed and capture victims' folder-specific credentials as they authenticate. The captured credentials can then be replayed to gain full access to protected directory subtrees.

Root Cause

The root cause is a race condition in the authorization flow where request logging occurs before authentication validation. The collaborator websocket was designed to share request information among users but fails to sanitize sensitive authentication headers before broadcasting. This architectural flaw exposes credentials to any connected websocket client, regardless of their authentication status.

Attack Vector

The attack is network-based and requires the following conditions:

1. The goshs server must be deployed without global basic authentication
2. The server must have folder-specific ACL protection configured using .goshs-protected directories
3. An attacker must connect to the collaborator websocket feed
4. A legitimate user must authenticate to a protected folder while the attacker is monitoring

Once these conditions are met, the attacker passively receives the victim's Authorization header through the websocket broadcast. The captured base64-encoded credentials can then be replayed to authenticate and perform file operations including reading, uploading, overwriting, and deleting files within the protected subtree.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40885

Indicators of Compromise

• Unusual websocket connections from unknown IP addresses to the goshs collaborator feed
• Multiple authentication attempts to protected folders from previously unseen sources following legitimate user access
• Log entries showing credential replay patterns with identical authorization headers from different source IPs

Detection Strategies

• Monitor websocket connection logs for suspicious clients connecting to the collaborator feed without subsequent authenticated requests
• Implement network traffic analysis to detect authorization header extraction patterns
• Review access logs for protected folder access originating from IP addresses that first appeared as websocket observers

Monitoring Recommendations

• Enable comprehensive logging for all websocket connections to the collaborator feed
• Configure alerting for authentication attempts to protected folders from new IP addresses within short timeframes
• Deploy network intrusion detection signatures to identify credential replay attack patterns

How to Mitigate CVE-2026-40885

Immediate Actions Required

• Upgrade goshs to version 2.0.0-beta.6 or later immediately
• Enable global basic authentication on all goshs deployments to prevent unauthorized websocket access
• Rotate all folder-specific ACL credentials that may have been exposed

Patch Information

The vulnerability has been fixed in goshs version 2.0.0-beta.6. Users should upgrade to this version or later to ensure protection. The fix addresses the authorization flow to ensure credentials are not broadcast through the collaborator websocket. For more details, see the GitHub Security Advisory.

Workarounds

• Deploy goshs with global basic authentication enabled (-P flag with -u and -p credentials) to prevent unauthenticated websocket access
• Disable the collaborator feature if not required for your deployment
• Place goshs behind a reverse proxy that handles authentication before requests reach the application
• Implement network-level access controls to restrict websocket endpoint access to trusted clients only

# Enable global basic authentication to prevent unauthorized websocket access
goshs -P -u admin -p your_secure_password

# Alternative: Deploy behind nginx with authentication
# nginx.conf snippet
# location /ws {
#     auth_basic "Restricted";
#     auth_basic_user_file /etc/nginx/.htpasswd;
#     proxy_pass http://localhost:8000;
#     proxy_http_version 1.1;
#     proxy_set_header Upgrade $http_upgrade;
#     proxy_set_header Connection "upgrade";
# }