CVE-2026-62314

{
  "id": "CVE-2026-62314",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T22:17:38.050",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1."
    },
    {
      "lang": "es",
      "value": "Anubis es una utilidad de cortafuegos web con IA que desafía las conexiones de los usuarios para proteger los recursos ascendentes de los bots raspadores. Desde la versión 1.22.0 hasta la 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() confiaba en el encabezado X-Original-URI controlado por el cliente antes de hacer coincidir r.URL.Path, lo que permitía a un cliente HTTP hacer coincidir reglas ALLOW predeterminadas de data/common/keep-internet-working.yaml como ^/\\.well-known/.*$ y eludir el desafío de Anubis. Este problema está solucionado en la versión 1.26.0-pre1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "TecharoHQ",
          "product": "anubis",
          "versions": [
            {
              "version": ">= 1.22.0, < 1.26.0-pre1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T17:50:19.423991Z",
          "id": "CVE-2026-62314",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TecharoHQ/anubis/pull/1630",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}