---
id: CVE-2026-91143
title: >-
  goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT
  tunnel requests, allowing unauthenticated clients to bypass credential
  requirements
summary: >-
  goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT
  tunnel requests, allowing unauthenticated clients to bypass credential
  requirements. Attackers can issue CONNECT requests to establish tunnels
  through the aut…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-288
vendor: snail007
product: goproxy
affected:
  - goproxy <= 15.3
published: '2026-09-14'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:47.747'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91143'
references:
  - url: 'https://github.com/geo-chen/oss/blob/main/goproxy.md'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/snail007/goproxy'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/snail007/goproxy/blob/v15.3/services/http.go'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/snail007/goproxy/blob/v15.3/utils/structs.go'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-via-connect
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00466
epssPercentile: 0.37734
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-15T19:12:03.554598Z'
ingestedAt: '2026-09-14T22:16:09.895Z'
---

## Overview

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.