CVE-2026-6993: go-kratos kratos up to 2.9.2 - Confused Deputy Issue in HTTP Server
Summary
CVE-2026-6993: Kratos has a Confused Deputy issue. Affects github.com/go-kratos/kratos/v2 versions < 2.9.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-kratos is a modern, lightweight framework for building microservices in Go. It provides a set of tools and libraries that simplify the development of robust and scalable applications. The framework is designed to be easy to use, with a focus on performance and maintainability. However, a security vulnerability has been identified in versions up to 2.9.2, which may expose applications to potential attacks due to improper handling of HTTP requests.
Vulnerability Detail
A Confused Deputy issue has been discovered in go-kratos kratos versions up to 2.9.2. This vulnerability arises from the function NewServer in the file transport/http/server.go, specifically within the http.DefaultServeMux Fallback Handler. The flaw allows an attacker to manipulate the server into acting as an unintended intermediary, potentially leading to unauthorized access or data exposure. The attack can be executed remotely, making it critical for users to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected HTTP server or implement additional validation checks on incoming requests to mitigate the risk of exploitation until the package is updated.
Conclusion
The vulnerability identified as CVE-2026-6993 in go-kratos kratos versions up to 2.9.2 poses a significant risk due to a Confused Deputy issue. It is crucial for users to update their packages to the patched version to mitigate potential attacks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for github.com/go-kratos/kratos/v2 →
FAQ
A Confused Deputy issue occurs when a system or application inadvertently misuses its authority, allowing an attacker to exploit its capabilities for malicious purposes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability could allow unauthorized access to sensitive data or enable attackers to manipulate server behavior, leading to further security breaches.
Yes, updating to the latest version of go-kratos that includes the patch for this vulnerability will ensure that your application is secure.
If immediate updates are not possible, consider implementing access restrictions and additional validation checks as a temporary workaround to reduce the risk of exploitation.
