CVE-2026-62314 Details
Description
Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.
A policy bypass vulnerability has been identified in Anubis, a Web AI Firewall Utility, in versions 1.22.0 prior to 1.26.0-pre1. The vulnerability arises because the PathChecker.Check() function in lib/policy/checker.go improperly trusts the client-controlled X-Original-URI header when matching request paths. This flaw allows HTTP clients to bypass Anubis challenges by exploiting default ALLOW rules that match certain paths, such as those under the well-known directory. As a result, requests can be forwarded to upstream resources without the usual bot protection measures.
Users can update to Anubis version 1.26.0-pre1, which addresses this vulnerability by modifying the PathChecker to properly handle the X-Original-URI and X-Forwarded-Uri headers, ensuring that path-based rules are correctly applied even when using Traefik as a reverse proxy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Aug 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4 | [email protected] | Source CodeVendor |
| https://github.com/TecharoHQ/anubis/pull/1630 | [email protected] | Issue TrackingVendor |
| https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1 | [email protected] | Release NotesVendor |
| https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TecharoHQ Anubis | >= 1.22.0, <= 1.25.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |