High severity · published Sep 14, 2026
CVE-2026-91143
goproxy through 15.3 Authentication Bypass via CONNECT
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
goproxy · snail007
through 15.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91143
github.com
https://github.com/geo-chen/oss/blob/main/goproxy.md
github.com
https://github.com/snail007/goproxy
github.com
https://github.com/snail007/goproxy/blob/v15.3/services/http.go
github.com
https://github.com/snail007/goproxy/blob/v15.3/utils/structs.go
www.vulncheck.com
https://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-via-connect