CVE-2026-62314 Anubis: Policy bypass via client controlled X-Original-URI header
Attackers can bypass Anubis bot protection challenges by spoofing the X-Original-URI header to match allow-listed paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62314?
CVE-2026-62314 is a medium-severity vulnerability in TecharoHQ anubis, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.
Weakness: CWE-284
Which versions are affected by CVE-2026-62314?
3 open source packages ship an affected version, including github.com/TecharoHQ/anubis.
| Package | Affected | Fixed in |
|---|---|---|
github.com/TecharoHQ/anubis Go | From 1.22.0 | 1.26.0 |
github.com/TecharoHQ/anubis Go | From 1.22.0 | 1.26.0 |
github.com/TecharoHQ/anubis Go | From 1.22.0 | 1.26.0 |
How do I fix CVE-2026-62314?
Upgrade github.com/TecharoHQ/anubis to 1.26.0 or later.
Is CVE-2026-62314 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62314 exists.
Sources
Also known as GHSA-6wcg-mqvh-fcvg, GO-2026-6639.