CVE-2026-91143

HIGH 7.2

goproxy through 15.3 Authentication Bypass via CONNECT

CVSS Score

7.2

EPSS Score

0.3%

EPSS Percentile

19th

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

CWE	CWE-288
Vendor	snail007
Product	goproxy
Published	Sep 14, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for snail007 goproxy

Be the first to know when new high vulnerabilities affecting snail007 goproxy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

snail007 / goproxy

0 ≤ 15.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/geo-chen/oss/blob/main/goproxy.md github.com: https://github.com/snail007/goproxy/blob/v15.3/utils/structs.go github.com: https://github.com/snail007/goproxy/blob/v15.3/services/http.go github.com: https://github.com/snail007/goproxy vulncheck.com: https://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-via-connect

Credits

🔍 George Chen