CVE-2026-91143: goproxy Authentication Bypass Vulnerability

CVE-2026-91143 Overview

CVE-2026-91143 is an authentication bypass vulnerability in goproxy through version 15.3. The proxy fails to enforce HTTP basic authentication on CONNECT tunnel requests, allowing unauthenticated clients to establish TCP tunnels through the proxy without providing credentials. This categorizes under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).

Attackers can relay arbitrary TCP traffic through the authenticated proxy, reach internal or restricted destinations, and use the proxy as an anonymizing pivot. The flaw affects deployments that rely on basic authentication as the sole access control for the proxy service.

Critical Impact
Unauthenticated attackers can tunnel arbitrary TCP traffic through goproxy, bypassing credential enforcement and abusing the proxy to reach restricted network destinations.

Affected Products

snail007/goproxy versions up to and including 15.3
Deployments configured with HTTP proxy basic authentication
Any service exposing the goproxy HTTP proxy listener with credentials enabled

Discovery Timeline

2026-09-14 - CVE-2026-91143 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91143

Vulnerability Analysis

The vulnerability resides in the HTTP proxy service of goproxy up to version 15.3. The proxy accepts two request types on its listener: standard HTTP proxy requests and CONNECT tunnel requests used for HTTPS and arbitrary TCP relay. Basic authentication enforcement is applied to the standard HTTP request path but is not applied to the CONNECT handler.

A client that issues a CONNECT host:port HTTP/1.1 request without a Proxy-Authorization header is granted a tunnel to the specified destination. The server establishes the outbound TCP connection and begins relaying bytes bidirectionally, treating the client as authenticated.

This behavior converts a credentialed proxy into an open relay for any protocol that can be spoken over TCP, including HTTPS, SMTP, SSH, and internal services reachable from the proxy host. Attackers can leverage the tunnel to bypass egress controls, reach intranet resources, or launder outbound connections through the proxy IP.

Root Cause

The authentication check logic in the HTTP service handler branches on request method before evaluating credentials. The CONNECT code path constructs the upstream tunnel without invoking the basic authentication validator that guards non-CONNECT requests. Refer to the GitHub goproxy HTTP Service Code and GitHub goproxy Structs Code for the affected implementation.

Attack Vector

Exploitation requires only network reachability to the proxy listener. An attacker sends a CONNECT request to the target proxy specifying any reachable host and port, omitting the Proxy-Authorization header. The proxy establishes the tunnel and forwards traffic without validating credentials.

See the VulnCheck goproxy Bypass Advisory for the disclosed technical details.

Detection Methods for CVE-2026-91143

Indicators of Compromise

Successful CONNECT tunnels in proxy logs where the request lacks a Proxy-Authorization header
Outbound TCP connections from the proxy host to destinations not associated with legitimate authenticated users
Anomalous traffic volume on the proxy listener from unexpected source addresses
Tunnels established to internal RFC1918 destinations from external client IPs

Detection Strategies

Parse goproxy access logs for CONNECT method entries and cross-reference with authentication events to identify unauthenticated tunnels
Deploy network detection rules that flag CONNECT requests to the proxy port without a preceding Proxy-Authorization header
Baseline expected destination hosts and alert on CONNECT targets outside the approved list

Monitoring Recommendations

Forward proxy logs to a centralized analytics platform and retain full request headers for forensic review
Monitor egress traffic originating from the proxy server for unusual destination diversity or protocol distribution
Track authentication failure and success ratios to detect enumeration or bypass patterns

How to Mitigate CVE-2026-91143

Immediate Actions Required

Restrict network access to the goproxy listener using firewall or security group rules limited to trusted source addresses
Disable the HTTP proxy service if it is not required, or place it behind an authenticated reverse proxy that enforces credentials on all methods
Audit proxy logs for historical CONNECT requests lacking Proxy-Authorization headers to identify prior abuse

Patch Information

No fixed release is referenced in the published advisory at the time of NVD publication. Monitor the GitHub goproxy Repository for a patched version beyond 15.3 that enforces basic authentication on the CONNECT handler.

Workarounds

Terminate client connections at an upstream reverse proxy (for example, nginx or HAProxy) that validates Proxy-Authorization on all methods including CONNECT before forwarding
Enforce mutual TLS or IP allowlisting at the network layer as a compensating control
Block the proxy port at the perimeter and require access through a VPN or bastion host

bash

# Example nginx-style allowlist restricting goproxy listener exposure
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP