CVE-2026-105299 | Cloudflare Pingora up to 0.8.x HTTP/1 Upstream Path httputil.ReverseProxy improper authorization

October 20, 2026 Yanac

A vulnerability was found in Cloudflare Pingora up to 0.8.x and classified as critical. This affects the function httputil.ReverseProxy of the component HTTP1 Upstream Path. The manipulation results in improper authorization.

This vulnerability is reported as CVE-2026-105299. The attack can be launched remotely. No exploit exists.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More