OpenNext Cloudflare CVE-2026-100409

Three conditions must all hold: (1) the application sets enableCacheInterception: true in open-next.config.ts (opt-in, non-default); (2) access control is enforced via Next.js middleware matchers rather than in-route checks; and (3) the protected route has a matching entry in the incremental cache. Exploitation is LIMITED by all three being deployment-specific - an app that does not enable cache interception, or that authorizes inside the route handler rather than middleware, or whose protected routes are never cached, is not exploitable. No user interaction or authentication is required once the configuration is present; the attacker only needs to know or guess a protected path and supply an equivalent percent-encoded or malformed encoding.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH) describes a network-reachable, unauthenticated authorization bypass with high confidentiality impact and no integrity or availability effect - consistent with the CWE-177 (improper URL-encoding handling) information-disclosure classification and the 'Information Disclosure' tag. However, the raw 7.5 overstates real-world risk because exploitation is gated on a specific non-default configuration (enableCacheInterception enabled AND middleware used for access control AND an actually-cached protected route), which the base CVSS score does not reflect. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV=NO and no public exploit code is referenced - only a vendor advisory, patch commit, and release are cited - so there is no evidence of active exploitation. The strongest contradiction to a 'drop everything' priority is the narrow precondition set versus the CVSS AC:L rating: once the vulnerable configuration exists, crafting the request is trivial, but the configuration itself is uncommon. Net: a credible, patch-worthy confidentiality issue for the specific affected deployments, not a broadly exploitable internet-wide emergency.

An application deployed on OpenNext Cloudflare with enableCacheInterception on, using middleware to gate an /admin route whose protected response has been cached, is targeted by a remote unauthenticated attacker. The attacker requests a percent-encoded path such as /%61dmin/... that fails the middleware authorization matcher but decodes to the cache key of the protected route, so the cached protected content is returned without authorization. No public exploit code is identified at time of analysis, though the fix commit and unit/e2e tests in the references demonstrate the exact bypass payloads.