CVE-2026-110619mediumCWE-306

CVE-2026-110619: falha de média gravidade em fatedier frp

frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints

Publicada em

Seguir esta CVE+ Monitorar frp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.8%
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
fatedier · frp
CVEs relacionadas — fatedier frp

No mesmo produto, das mais perigosas para as menos.

CVE-2026-73564HIGHfrp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer OverflowEPSS 0.5%CVE-2026-40910MEDIUMfrp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access controlEPSS 0.3%