Back to overview

CVE-2026-62314

MEDIUM
5.8
CVSS 3.1
Description
Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.

Metadata

CVE ID
CVE-2026-62314
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-07-13 19:27 UTC
Published
2026-07-15 21:18 UTC
Last updated
2026-07-15 21:18 UTC
Primary CWE
CWE-284
CWE-284: Improper Access Control
Vendor / Product
TecharoHQ / anubis
Sources
cve.org  ·  NVD

Severity & Metrics

5.8 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected products (1)
VendorProductPlatformVersions
TecharoHQ anubis — >= 1.22.0, < 1.26.0-pre1
Weakness (CWE)
CWESourceDescription
CWE-284 cna CWE-284: Improper Access Control
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.8 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
References (4)
Back to overview