CVE-2026-68548

CVSS 9.4 (critical) · published 2026-11-12

Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.

Weakness: CWE-178, CWE-863

Source: NVD CVE-2026-68548

References

• https://github.com/xyproto/algernon/releases/tag/v1.17.10
• https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx
• https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.