CVE-2026-118681

Low

Description

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.

SeverityLow

CVSS3.7

Exploit probability—

ProductChi

PublishedOct 28, 2026

First seenNov 4, 2026

Weakness typeCWE-288CWE-288

How to fix

Update

go-chi chi5.5.0 or later

Vendor advisories

github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958

Affected products

Product	Affected versions	Fixed in
go-chi chi	v < 5.5.0	5.5.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.