Weaknesses of type CWE-441

231 results

Deputado Confuso (Proxy ou Intermediário Não Intencional)

Quando um componente intermediário (servidor, API, função, etc.) executa ações em nome de um cliente sem validar adequadamente quem realmente autorizou aquela ação, um atacante consegue explorar a confiança já estabelecida entre esse intermediário e outros sistemas. O intermediário acaba agindo como 'procurador involuntário' do atacante, realizando operações que o sistema final nunca autorizaria se a requisição viesse diretamente do atacante.

Example

Um servidor de cache proxy que aceita requisições GET de qualquer origem e as repassa a um serviço interno sem verificar se o cliente original deveria ter acesso àqueles dados. Um atacante faz o proxy buscar informações sensíveis do servidor interno e devolver para si, usando a confiança que o servidor interno tem no proxy.

How to mitigate

Valide a identidade e autorização do cliente original antes de repassar requisições para sistemas internos; use tokens ou assinaturas criptográficas que viagem junto com a requisição; implemente listas de origem segura (whitelist) rigorosas e autenticação mútua entre componentes intermediários e backends.

CVE-2026-42313HIGHpyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxyEPSS 0.4%CVE-2024-34068MEDIUMServer-side Request Forgery during remote file pull in Pterodactyl wingsEPSS 0.4%CVE-2024-9870MEDIUMUnintended Proxy or Intermediary ('Confused Deputy') in GitLabEPSS 0.4%CVE-2026-87582HIGHConfused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process tEPSS 0.4%CVE-2026-73079HIGHSub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentialsEPSS 0.4%CVE-2026-73424MEDIUMAstro: Unauthenticated path override in the @astrojs/vercel ISR functionEPSS 0.4%CVE-2026-16158HIGH@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collisionEPSS 0.4%CVE-2026-113202HIGHConfused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to EPSS 0.4%CVE-2026-113024HIGHConfused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafteEPSS 0.4%CVE-2026-113301HIGHConfused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions viaEPSS 0.4%CVE-2026-72640MEDIUMUnintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret DisclosureEPSS 0.4%CVE-2026-106228HIGHConfused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process toEPSS 0.4%CVE-2026-113127HIGHConfused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged pEPSS 0.4%CVE-2026-101897MEDIUMAngular DevTools (Local DoS)EPSS 0.4%CVE-2026-73266HIGHClusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset joinEPSS 0.4%CVE-2026-24471CRITICALImproper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')EPSS 0.3%CVE-2026-27624HIGHCoturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACLEPSS 0.3%CVE-2026-33768MEDIUMAstro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`EPSS 0.3%CVE-2026-53999HIGHRadius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)EPSS 0.3%CVE-2026-103922CRITICALCapacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathEPSS 0.3%