Evidence-led vulnerability intelligence · 2026-11-13 01:48 IST

CVE-2026-68548

Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.

CRITICAL · 9.4macOS / Apple Windows

Executive briefing

A structured intelligence assessment has not yet been generated. The source description is shown above. The background enrichment worker will retry this record.

Assessment: Potential exposure only — validate product, version, configuration and vendor applicability.

Evidence confidence: Not assessed Evidence-derived, not an exploitability verdict

Severity & attack characteristics

9.4 / 10 · 3.1

CVSS vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack vectorN

Attack complexityL

Privileges requiredN

User interactionN

ScopeU

Confidentiality impactH

Integrity impactH

Availability impactL

Technical explanation & impact

Technical root-cause details are not available in the current source record.

Assess the impact using the published CVSS metrics and the affected vendor component.

Affected products and versions

NVD has not supplied machine-readable vulnerable CPE product/version entries for this CVE. This is an information gap, not proof that no products are affected. Check the vendor advisory references below.

Remediation & validation

Identify exposure by comparing the affected product and version ranges with your asset inventory, SBOM and externally exposed services.
Review the linked vendor security advisory or patch notes. Upgrade to a vendor-confirmed fixed release; do not infer a fixed version from the CVE description.
Until patched, consider restricting network access or disabling the affected feature where operationally safe. These are temporary controls, not a substitute for a vendor fix.
Validate the remediation with a version check and vulnerability rescan, then retain change evidence.

No fixed version is displayed unless it is explicitly established by a vendor advisory. Follow the vendor's release notes for exact product and branch applicability.

Vendor advisories, patches & exploit references

https://github.com/xyproto/algernon/releases/tag/v1.17.10 VENDOR security-advisories@github.com
https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx VENDOR security-advisories@github.com
https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx VENDOR 134c704f-9b21-4f2e-91b3-4a467353bcc0

Open NVD record ← Back to CVE Watch