Anubis CVE-2026-62314

Exploitation requires that Anubis is deployed as an HTTP intermediary (reverse proxy or subrequest auth endpoint) accessible to the attacker over the network, and that the target deployment uses the default data/common/keep-internet-working.yaml policy or any other policy containing ALLOW rules with path regex patterns the attacker can match via a crafted header value (e.g., ^/\.well-known/.*$, ^/robots\.txt$). The vulnerability is present in both direct-proxy and subrequest (nginx/Traefik) deployment modes because the header was read unconditionally. The attacker must be able to send HTTP requests with arbitrary headers to Anubis; if the upstream proxy strips or blocks X-Original-URI before reaching Anubis, exploitation is prevented. Exploitation is limited to Anubis versions 1.22.0-pre-1.26.0-pre1 and is not possible against installations that have removed all regex ALLOW rules from their policy configuration.

The NVD-assigned CVSS 3.1 score of 5.8 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N accurately characterizes the real-world risk profile. Attack complexity is genuinely low - exploitation requires only a single HTTP header, no authentication, and no user interaction, making this automatable and accessible to unsophisticated actors. The scope change (S:C) reflects that Anubis itself is the security control, and bypassing it exposes upstream components outside Anubis's own trust boundary. Confidentiality impact is capped at Low (C:L) because the bypass grants access to upstream resources but does not directly exfiltrate data from Anubis itself. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be numerically quantified. There is no CISA KEV listing and no public POC, which reduces immediate urgency. However, the bypass is mechanically trivial - any scripted HTTP client can replicate it - and Anubis deployments exist specifically to protect against high-volume automated scraping, meaning successful bypass defeats the product's primary purpose entirely. Defenders using Anubis to gate access to protected upstream resources should treat this as operationally high priority despite the medium CVSS score.

An attacker targeting a site protected by Anubis sends an HTTP GET request to any Anubis-guarded endpoint and includes the header X-Original-URI: /.well-known/acme-challenge/bypass. Anubis reads the client-supplied header, evaluates the path against the default ALLOW rules in keep-internet-working.yaml, matches the ^/\.well-known/.*$ pattern, and forwards the request to the upstream resource without issuing a bot challenge. The attacker can then scrape or interact with the upstream service at will, defeating the entire purpose of the Anubis deployment. No exploit code is publicly available but the technique is fully described by the CVE and patch diff.