CVE-2026-110619
CVE-2026-110619 · frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.
CVSS 6.3 · Media · EPSS 0,8%
- Publicación
- Actualización
Productos y versiones afectados
frp
- Versiones
- ≥ 0.41.0, ≤ 0.71.1: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyZWPT3jfe
- https://github.com/fatedier/frp/blob/v0.71.1/pkg/util/http/server.go#L124-L130
- https://github.com/fatedier/frp/blob/v0.71.1/server/api_router.go#L27-L32
- https://github.com/fatedier/frp
- https://www.vulncheck.com/advisories/frp-0.41.0-through-0.71.1-missing-authentication-for-pprof-debug-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-110619