CVE-2026-6993: go-kratos Kratos RCE Vulnerability

CVE-2026-6993 Overview

A security flaw has been discovered in go-kratos kratos up to version 2.9.2. This vulnerability impacts the function NewServer in the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in an unintended intermediary condition (CWE-441). The attack may be launched remotely, and exploit information has been released to the public and may be used for attacks.

Critical Impact
This vulnerability allows remote attackers to exploit an unintended intermediary condition in the HTTP server component, potentially enabling request routing manipulation and unauthorized access to backend services through the fallback handler mechanism.

Affected Products

go-kratos kratos versions up to 2.9.2
Applications using the transport/http/server.go NewServer function
Systems relying on http.DefaultServeMux fallback handler behavior

Discovery Timeline

2026-04-25 - CVE CVE-2026-6993 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-6993

Vulnerability Analysis

This vulnerability is classified as CWE-441 (Unintended Proxy or Intermediary), which occurs when the software receives a request intended for another entity and forwards that request to the intended entity. In the context of go-kratos kratos, the NewServer function in transport/http/server.go improperly handles requests through the http.DefaultServeMux fallback handler.

The flaw exists because when a custom HTTP server is created using the kratos framework, requests that don't match any registered routes may inadvertently fall through to the Go standard library's http.DefaultServeMux. This creates an unintended intermediary condition where requests could be routed to handlers registered on the default serve mux by other parts of the application or third-party libraries.

Root Cause

The root cause stems from the kratos HTTP server's fallback behavior when handling unmatched routes. When the NewServer function initializes the HTTP server without explicitly configuring a handler for unmatched paths, the framework defaults to using http.DefaultServeMux. This design decision creates a potential security gap where:

Other components or libraries may register handlers on the global DefaultServeMux
Requests intended for the kratos application could be inadvertently routed to these unrelated handlers
Attackers could craft requests that bypass the intended routing logic

Attack Vector

The vulnerability is exploitable remotely via network-based attacks. An attacker can manipulate HTTP requests to exploit the fallback handler mechanism:

The attacker sends specially crafted HTTP requests to the kratos-based application
These requests are designed to not match any explicitly registered routes
The requests fall through to the http.DefaultServeMux fallback handler
If other handlers exist on the default mux, the requests may be processed by unintended code paths
This can lead to unauthorized access, information disclosure, or other security impacts depending on what handlers are registered on the default mux

The vulnerability mechanism involves improper request routing in the NewServer function. When requests don't match registered routes, they fall through to http.DefaultServeMux, which may have handlers registered by other application components or third-party libraries. For technical details, refer to GitHub Issue #3810 and Pull Request #3814.

Detection Methods for CVE-2026-6993

Indicators of Compromise

Unexpected HTTP requests reaching handlers not explicitly registered in your kratos application
Log entries showing requests being processed by http.DefaultServeMux when they should be handled by kratos routes
Anomalous access patterns to endpoints that don't exist in the application's defined routes

Detection Strategies

Monitor application logs for requests that fail route matching but still receive responses
Implement request auditing to track which handler processes each incoming request
Review application dependencies for components that may register handlers on http.DefaultServeMux
Use network monitoring to identify unusual request patterns targeting non-existent endpoints

Monitoring Recommendations

Enable verbose logging for the kratos HTTP server component to track request routing decisions
Deploy application performance monitoring (APM) to visualize request flow through the application
Implement alerting for requests processed by unexpected handlers
Conduct regular security audits of registered handlers on both kratos and http.DefaultServeMux

How to Mitigate CVE-2026-6993

Immediate Actions Required

Upgrade go-kratos kratos to a version containing the patch commit 0284a5bcf92b5a7ee015300ce3051baf7ae4718d
Review your application for any handlers registered on http.DefaultServeMux and assess their security implications
Implement explicit 404 handlers in your kratos application to prevent fallback to default mux
Audit third-party dependencies for potential DefaultServeMux handler registrations

Patch Information

The patch is identified as commit 0284a5bcf92b5a7ee015300ce3051baf7ae4718d. This fix addresses the unintended intermediary condition in the NewServer function. Users should apply this patch or upgrade to a version that includes this fix. For more details, see GitHub Pull Request #3814 and the patch commit.

Workarounds

Explicitly configure a catch-all handler in your kratos application to prevent requests from falling through to http.DefaultServeMux
Isolate your kratos application in a separate process to avoid sharing the DefaultServeMux with other components
Implement strict request validation at the network edge (reverse proxy, API gateway) to filter unexpected requests
Use Go's http.NewServeMux() to create isolated mux instances instead of relying on the default global mux

bash

# Verify kratos version and check for the patch
go list -m github.com/go-kratos/kratos/v2
# Update to patched version
go get github.com/go-kratos/kratos/v2@latest
go mod tidy