CVE-2026-62314 – Anubis: Policy bypass via client controlled X-Original-URI header

CVE ID :CVE-2026-62314

Published : July 15, 2026, 9:18 p.m. | 16 minutes ago

Description :Anubis is a Web AI Firewall Utility that challenges users’ connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/.well-known/.*$ and bypass the Anubis challenge. This issue is fixed in version 1.26.0-pre1.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…