frp CVE-2026-110619

Requires the frps dashboard HTTP listener or the frpc admin UI listener to be enabled and network-reachable by the attacker; these administrative interfaces are configuration-dependent and not part of a minimal default frp deployment. Once reachable, no authentication, privileges, or user interaction are needed, because the pprof handlers are registered on the root mux outside the Basic Authentication middleware that normally protects these interfaces - so even deployments that configured dashboard/admin credentials remain exposed. The principal limiting factor is network exposure of the frps dashboard or frpc admin port; environments that bind these interfaces to localhost or firewall them off are not remotely exploitable.

This is a medium-severity, defense-in-depth issue rather than a top-tier emergency. The provided CVSS 4.0 vector (6.3) shows network reach (AV:N), low complexity (AC:L) and no privileges or user interaction (PR:N/UI:N), but it is tempered by a present attack requirement (AT:P) and strictly low technical impact (VC:L information disclosure, VI:N, VA:L minor availability), with no scope change to subsequent systems. The AT:P flag is the key signal: exploitation is gated on the frps dashboard or frpc admin HTTP listener being enabled and reachable, which is a configuration-dependent precondition, not a default-on remote service. No EPSS score and no SSVC decision data were provided, so exploitation probability and automatability cannot be quantified from the input. The CVE is NOT on CISA KEV and no public exploit code was identified (only a technical write-up and vendor advisory are referenced), so there is no evidence of active exploitation. Net: this is a legitimate but modest-priority fix - real because frp is widely deployed and the bypass defeats Basic Auth on an administrative surface, but the low impact ceiling and the requirement for an exposed admin/dashboard interface keep real-world risk well below the alarm implied by 'unauthenticated remote.' EPSS and SSVC data are MISSING and should be obtained before final prioritization.

An attacker who can reach an exposed frps dashboard port or frpc admin listener sends unauthenticated HTTP GET requests to /debug/pprof/ endpoints and retrieves process cmdline, goroutine stacks and heap/memory profiles that may leak internal configuration, tokens, or network topology. By requesting the CPU-profiling endpoint the attacker can also impose processing load on the target. No public exploit code is identified, though a technical write-up describing the issue exists.