Vulnerabilidades do Fatedier Frp
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Fatedier Frp: 2 registro(s), com versões afetadas e correções.cpe:2.3:a:fatedier:frp
CVE-2026-110619
Média · 4.8
CWE-306 14/10/2026
frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.
CVE-2026-40910
Crítica · 9.1
CWE-287 21/04/2026
frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control
frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.