CVE-2026-6993mediumCWE-441

CVE-2026-6993: medium-severity vulnerability in go-kratos kratos

go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputy

Published · Updated

Follow this CVE+ Monitor kratos+ Monitor github.com/go-kratos/kratos/v2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.3%
A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 0284a5bcf92b5a7ee015300ce3051baf7ae4718d. Applying a patch is advised to resolve this issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
go-kratos · kratos
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.