CVE-2026-86804: CPA-Manager-Plus Auth Bypass Vulnerability

CVE-2026-86804 Overview

CVE-2026-86804 is an improper authorization vulnerability [CWE-266] in seakee CPA-Manager-Plus versions up to 1.11.10. The flaw resides in the CPAResource function within apps/manager-server/internal/http/controller/proxy/handler.go, part of the HTTP Handler component. The handler conditionally enforced authentication only on state-changing HTTP methods, allowing unauthenticated GET and HEAD requests to reach protected proxy resources. Remote attackers can exploit the flaw over the network without user interaction. The maintainers released version 1.11.11 containing patch commit 842eec791377ddcbea5cd639bc065eaa4801d656 to address the issue.

Critical Impact
Remote unauthenticated attackers can bypass authorization checks and access proxied CPA resources by issuing HTTP GET or HEAD requests to the affected endpoint.

Affected Products

seakee CPA-Manager-Plus versions up to and including 1.11.10
Component: HTTP Handler (apps/manager-server/internal/http/controller/proxy/handler.go)
Function: CPAResource

Discovery Timeline

2026-09-08 - CVE-2026-86804 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86804

Vulnerability Analysis

The CPAResource handler in CPA-Manager-Plus proxies requests to CPA-managed backend resources. The pre-patch implementation only invoked AdminAuthService.VerifyHeader for mutating HTTP methods such as POST, PUT, PATCH, and DELETE. Read methods including GET and HEAD were served without authorization enforcement. This asymmetric access control model let unauthenticated clients enumerate and retrieve proxied plugin resources that should have required an administrative bearer token. The scope of exposed data is limited to information reachable via the proxy route, which aligns with the low confidentiality impact reflected in the vendor score.

Root Cause

The root cause is an incomplete authorization check tied to HTTP method dispatch. The useSavedManagementKey flag defaulted to true and was only re-evaluated for write methods. As a result, read requests unconditionally proceeded using the server's saved management key, effectively bypassing the caller identity check. This maps to CWE-266: Incorrect Privilege Assignment, where the request executes with privileges belonging to the server rather than the requester.

Attack Vector

Exploitation requires only network reachability to the manager-server HTTP endpoint. No credentials, tokens, or user interaction are needed. An attacker sends a crafted GET or HEAD request to the CPAResource route, and the handler processes it using the saved management key without verifying the Authorization header. Public proof-of-concept code is not listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

// Patch diff for apps/manager-server/internal/http/controller/proxy/handler.go
func (h *Handler) CPAResource(w http.ResponseWriter, r *http.Request) {
-	useSavedManagementKey := true
 	switch r.Method {
-	case http.MethodGet, http.MethodHead:
-	case http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete:
-		ok, err := h.App.AdminAuthService.VerifyHeader(r.Context(), r.Header.Get("Authorization"))
-		if err != nil {
-			response.Error(w, http.StatusInternalServerError, err)
-			return
-		}
-		useSavedManagementKey = ok
+	case http.MethodGet,
+		http.MethodHead,
+		http.MethodPost,
+		http.MethodPut,
+		http.MethodPatch,
+		http.MethodDelete:
 	default:
 		response.MethodNotAllowed(w)
 		return
 	}
-	if useSavedManagementKey {
+
+	ok, err := h.App.AdminAuthService.VerifyHeader(r.Context(), r.Header.Get("Authorization"))
+	if err != nil {
+		response.Error(w, http.StatusInternalServerError, err)
+		return
+	}

Source: GitHub Commit 842eec7. The fix consolidates all supported methods into a single case and unconditionally calls VerifyHeader before proceeding.

Detection Methods for CVE-2026-86804

Indicators of Compromise

Unauthenticated GET or HEAD requests to the CPAResource proxy route returning HTTP 200 responses
Access log entries for the manager-server missing an Authorization header on read requests to proxy paths
Unexpected access to CPA plugin resources originating from non-administrative source IPs

Detection Strategies

Inspect reverse-proxy and application logs for requests to the CPA proxy endpoint that lack a valid bearer token
Compare source IP ranges of read requests against the allowlist of administrative operators
Alert on sudden spikes in GET traffic to /CPAResource paths from previously unseen clients

Monitoring Recommendations

Enable verbose HTTP access logging on manager-server, including request method, path, and Authorization header presence
Forward manager-server logs to a centralized analytics platform for correlation across hosts and time windows
Track the deployed CPA-Manager-Plus version across your fleet and flag any instance below 1.11.11

How to Mitigate CVE-2026-86804

Immediate Actions Required

Upgrade CPA-Manager-Plus to version 1.11.11 or later, which includes patch commit 842eec7
Restrict network access to the manager-server HTTP interface using firewall rules or a reverse proxy allowlist
Rotate any saved management keys that may have been used to serve unauthenticated read requests
Audit access logs since deployment for unauthorized reads against the CPAResource route

Patch Information

The fix is delivered in GitHub Release v1.11.11 and merged via Pull Request #463, which resolves Issue #462. The patch removes the method-based bypass and enforces AdminAuthService.VerifyHeader on all accepted methods. Additional details are available in the VulDB entry for CVE-2026-86804.

Workarounds

Place the manager-server behind an authenticating reverse proxy that rejects requests without a valid Authorization header
Block external network access to the CPAResource route until the upgrade is applied
Apply the upstream patch as an out-of-band code change if upgrading the full release is not immediately feasible

bash

# Verify installed version and upgrade
git -C /opt/CPA-Manager-Plus describe --tags
git -C /opt/CPA-Manager-Plus fetch --tags
git -C /opt/CPA-Manager-Plus checkout v1.11.11
cd /opt/CPA-Manager-Plus && go build ./... && systemctl restart manager-server