CVE-2026-0650

Flagr - Missing Authentication

Title source: rule

Description

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.

References (3)

[Various Sources] https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass

[Third Party Advisory] https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization

[Release Notes] https://github.com/openflagr/flagr/releases/tag/1.1.19

Scores

EPSS 0.0013

EPSS Percentile 32.7%

Classification

CWE

CWE-306 CWE-425

Status draft

Affected Products (1)

openflagr/flagr < 0.0.0-20251009103504-fe83dc87aa40Go

Timeline

Published Jan 07, 2026

Tracked Since Feb 18, 2026