CVE-2026-118681 Details
Description
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
A vulnerability allowing authentication bypass has been identified in go-chi chi versions prior to 5.5.0. The issue arises in the SupressNotFound middleware, which improperly handles the routing context. This flaw allows unauthenticated attackers to access mounted paths that intersect with public routes, bypassing authentication middleware and potentially exposing sensitive tenant-specific data.
To address this vulnerability, it is recommended to update to chi version 5.5.0 or later. Additionally, applications can remove the SupressNotFound middleware or enforce authorization at a higher level in the route hierarchy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/go-chi-chi-before-5.5.0-authentication-bypass-via-supressnotfound-middleware | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| go-chi/chi | <= 5.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |