CVE-2026-76169

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Published

Sep 4, 2026, 9:51:03 AM UTC

Updated

Sep 4, 2026, 10:17:12 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.53% · Oct 25, 2026

A flaw was found in fastify. Malformed URLs can be routed to a custom not-found handler of a different plugin, bypassing the intended security checks. This allows an unauthenticated attacker to access and read the full response of an authentication-protected private fallback, leading to information disclosure and an authentication bypass. fastify: fastify: Authentication bypass via malformed URLs This is an Important flaw in fastify that allows an unauthenticated attacker to bypass authentication hooks. By sending a specially crafted malformed URL, an attacker can access private fallback handlers and read their responses, thereby circumventing intended access controls in Red Hat OpenShift AI and Red Hat OpenShift Dev Spaces deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.