Reverse Proxy Vulnerability in BusyBox httpd Affects Multiple Server Configurations
CVE-2026-88829

7.2HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Hardened Images
Vendor
CVE Published:
14 October 2026

What is CVE-2026-88829?

A security flaw in BusyBox httpd's reverse proxy feature allows attackers to exploit improperly configured URL forwarding. When the proxy forwards requests to a backend server, only the initial HTTP request's path is rewritten. This oversight permits an attacker to send subsequent pipelined requests that bypass intended path restrictions, granting them access to arbitrary paths on the backend server. Proper configuration and rigorous security measures are essential to mitigate the risks associated with this vulnerability.

References

https://access.redhat.com/security/cve/CVE-2026-88829
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2531343
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.
.