CVE-2026-62314

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62314", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-13T19:27:58.314Z", "datePublished": "2026-07-15T21:18:00.355Z", "dateUpdated": "2026-08-12T17:50:22.279Z"}, "containers": {"cna": {"title": "Anubis: Policy bypass via client controlled X-Original-URI header", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg"}, {"name": "https://github.com/TecharoHQ/anubis/pull/1630", "tags": ["x_refsource_MISC"], "url": "https://github.com/TecharoHQ/anubis/pull/1630"}, {"name": "https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4", "tags": ["x_refsource_MISC"], "url": "https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4"}, {"name": "https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1", "tags": ["x_refsource_MISC"], "url": "https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1"}], "affected": [{"vendor": "TecharoHQ", "product": "anubis", "versions": [{"version": ">= 1.22.0, < 1.26.0-pre1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T21:18:00.355Z"}, "descriptions": [{"lang": "en", "value": "Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1."}], "source": {"advisory": "GHSA-6wcg-mqvh-fcvg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:50:19.423991Z", "id": "CVE-2026-62314", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:50:22.279Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62314", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T17:50:19.423991Z"}}}], "references": [{"url": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T12:47:23.013Z"}}], "cna": {"title": "Anubis: Policy bypass via client controlled X-Original-URI header", "source": {"advisory": "GHSA-6wcg-mqvh-fcvg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "TecharoHQ", "product": "anubis", "versions": [{"status": "affected", "version": ">= 1.22.0, < 1.26.0-pre1"}]}], "references": [{"url": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg", "name": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TecharoHQ/anubis/pull/1630", "name": "https://github.com/TecharoHQ/anubis/pull/1630", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4", "name": "https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1", "name": "https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T21:18:00.355Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62314", "state": "PUBLISHED", "dateUpdated": "2026-08-12T17:50:22.279Z", "dateReserved": "2026-07-13T19:27:58.314Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-15T21:18:00.355Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "anubis", "vendor": "TecharoHQ", "versions": [{"status": "affected", "version": ">= 1.22.0, < 1.26.0-pre1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1."}, {"lang": "es", "value": "Anubis es una utilidad de cortafuegos web con IA que desaf\u00eda las conexiones de los usuarios para proteger los recursos ascendentes de los bots raspadores. Desde la versi\u00f3n 1.22.0 hasta la 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() confiaba en el encabezado X-Original-URI controlado por el cliente antes de hacer coincidir r.URL.Path, lo que permit\u00eda a un cliente HTTP hacer coincidir reglas ALLOW predeterminadas de data/common/keep-internet-working.yaml como ^/\\.well-known/.*$ y eludir el desaf\u00edo de Anubis. Este problema est\u00e1 solucionado en la versi\u00f3n 1.26.0-pre1."}], "id": "CVE-2026-62314", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62314", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T17:50:19.423991Z", "version": "2.0.3"}}]}, "published": "2026-07-15T22:17:38.050", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4"}, {"source": "security-advisories@github.com", "url": "https://github.com/TecharoHQ/anubis/pull/1630"}, {"source": "security-advisories@github.com", "url": "https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1"}, {"source": "security-advisories@github.com", "url": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.22.0,1.26.0-pre1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "anubis", "source": "cna", "vendor": "TecharoHQ"}, "product": "anubis", "vendor": "techarohq"}], "created": "2026-07-16T00:45:04.624334+00:00", "updated": "2026-07-31T02:45:04.356461+00:00", "vendors": ["techarohq", "techarohq$PRODUCT$anubis"]}