go-chi chi CVE-2026-118681

Exploitation requires all of the following application-specific prerequisites, not merely use of chi: (1) middleware.SupressNotFound must be enabled on the outer router; (2) a mounted subrouter (e.g. via Router.Route("/{tenant}", ...)) protected by authentication middleware whose child path suffix collides with (3) an explicit outer public route of the same suffix (e.g. GET /data/{id}); and (4) that outer public handler must reuse a tenant-aware handler that trusts the retained mount parameter read via Request.PathValue / chi.URLParam. When these align, an unauthenticated (PR:N) remote request to the mounted path has its routing context mutated by the preflight Match so the public handler runs with the retained tenant parameter, skipping the mounted auth middleware. LIMITING FACTORS: the attack requirement (AT:P) is substantial - an outer route that independently enforces authorization, or an absence of a colliding public suffix handler, eliminates the impact (the advisory's mounted-only control returns 404, not a bypass); impact is confined to disclosure of tenant-scoped read data. Runtime confirmation exists only for v5.4.0.

Signals are mixed and point to a conditional, medium-severity authentication bypass rather than a broad emergency. The supplied CVSS 4.0 base score is 6.3 (medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N and only limited confidentiality impact (VC:L, VI:N, VA:N, no subsequent-system impact), which aligns with the mechanism: an unauthenticated network request can reach an outer public handler and read tenant-scoped data, but cannot modify or deny it. The SSVC-style decision label supplied is 'this_month' (not act_now/emergency), consistent with a real but non-urgent priority. No EPSS probability was provided in the input, so widespread-exploitation likelihood cannot be quantified from this data. The CVE is NOT listed in CISA KEV and there is no claim of active exploitation; however, a working proof-of-concept reproduction (an httptest harness with observed output) is published in the go-chi GHSA advisory for v5.4.0, so exploit knowledge is public. The AT:P metric (attack requirements present) is the key honest caveat: exploitation is not against arbitrary chi deployments - it requires a specific routing collision plus an outer public handler that reuses a tenant-aware handler trusting the retained mount parameter. The advisory itself states that an outer route independently enforcing authorization would not be impacted. Net: a genuine authentication-bypass bug in a very widely used Go router, but real-world risk is gated by application-specific configuration, so this is a medium priority to patch promptly rather than a high-CVSS, mass-exploitable crisis.

A multi-tenant Go service built on chi mounts an authenticated subrouter at /{tenant}/data/{id} and also exposes a public /data/{id} route backed by the same tenant-aware handler, with middleware.SupressNotFound enabled on the outer router. An unauthenticated attacker requests /acme/data/42; the SupressNotFound preflight Match mutates the live routing context so the outer public handler runs while retaining tenant=acme, returning acme's tenant-scoped resource without any token. A published working reproduction in the GHSA advisory demonstrates exactly this (401 becomes 200 once SupressNotFound is enabled), verified against chi v5.4.0.