Coraza WAF EUVD-2026-106902

Exploitation requires the target application to run Coraza 3.0.0-3.8.1 with the JSON body processor active and to inspect request bodies using OWASP CRS (or equivalent rules keyed on ARGS_POST). The attacker needs no authentication or user interaction and sends a crafted JSON body containing a nested property whose literal name, when flattened with an unescaped dot, collides with a sibling dotted-key decoy, letting the later value overwrite the malicious one in Coraza's map. The critical LIMITING factor is that this only bypasses WAF detection - real impact depends on the protected backend having an actual injectable sink (e.g. SQL injection) for the hidden payload; applications without such a downstream vulnerability lose detection but suffer no direct compromise. It also requires the backend JSON parser to preserve both distinct properties (standard Go/most parsers do).

This is a WAF-inspection bypass in Coraza (the OWASP Go WAF engine), not a direct code-execution flaw, and the signals are internally consistent toward a moderate-but-real priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scoring 6.9 correctly reflects remote, unauthenticated, low-complexity reachability with no special attack requirements; impact is limited to integrity (VI:L/SI:L, VC/VA/SC/SA:N) because the bug does not itself compromise data - it suppresses detection so that a separately-exploitable backend payload (e.g. SQL injection) slips past OWASP CRS. No EPSS score, CISA KEV entry, or standalone exploit-tool signal was provided in the input, so the 6.9 is a severity estimate rather than evidence of mass exploitation. However, the GHSA advisory supplies a concrete control-pair proof-of-concept JSON that demonstrably turns a CRS rule 949110 block into a pass, so working exploit knowledge is effectively public. The practical risk is conditional: it only matters where Coraza fronts a backend that is itself injectable, so treat it as a real defense-in-depth regression (your WAF stops protecting) rather than a standalone critical. EPSS is absent, not low - do not read its omission as a low-exploitation signal; VulnCheck (the reporter) is a credible exploitation-intelligence source.

An unauthenticated attacker sends a JSON POST to an application protected by Coraza with the OWASP Core Rule Set, placing a SQL-injection payload in a nested property (account.role) and appending a sibling literal-dotted decoy property 'account.role' with a benign value. Coraza flattens both into the same ARGS_POST:json.account.role variable and the decoy overwrites the malicious value, so CRS inspects only the harmless string, while the Go backend's standard JSON parser still receives and processes the live injection. A proof-of-concept demonstrating exactly this CRS v4.25 bypass is published in the GHSA advisory.