CVE-2026-110619 Details

A missing authentication vulnerability has been identified in frp versions 0.41.0 through 0.71.1. This vulnerability allows unauthenticated remote attackers to access pprof debug endpoints. The issue arises because pprof handlers are registered on the root router without Basic Authentication, leaving them exposed. Attackers can exploit this to query various pprof endpoints on the frps dashboard or frpc admin listeners, potentially accessing sensitive runtime information such as command-line arguments, goroutine stacks, heap profiles, and CPU profiling data.

To address this vulnerability, pprof handlers should be registered under the authenticated subrouter or the authentication middleware should be applied to the pprof routes explicitly. Additionally, consider binding pprof to a separate loopback-only listener to keep it off the public-facing dashboard.