OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-0650 · Microsoft / collected KEV context

EUVD-2026-1181

GHSA-rwp9-5g7q-73q3

GO-2026-4286

cve-program · CVE-2026-0650

• https://github.com/openflagr/flagr/releases/tag/1.1.19
• https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass
• https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization

euvd · EUVD-2026-1181

• https://github.com/openflagr/flagr/releases/tag/1.1.19
• https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass
• https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization

nvd · CVE-2026-0650

• https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass
• https://github.com/openflagr/flagr/releases/tag/1.1.19
• https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization

osv · GHSA-rwp9-5g7q-73q3

• https://nvd.nist.gov/vuln/detail/CVE-2026-0650
• https://github.com/openflagr/flagr/commit/fe83dc87aa404a57554aa5839ac450f55c203570
• https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass
• https://github.com/openflagr/flagr
• https://github.com/openflagr/flagr/releases/tag/1.1.19
• https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization

osv · GO-2026-4286

• https://github.com/advisories/GHSA-rwp9-5g7q-73q3
• https://nvd.nist.gov/vuln/detail/CVE-2026-0650
• https://github.com/openflagr/flagr/commit/fe83dc87aa404a57554aa5839ac450f55c203570
• https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass
• https://github.com/openflagr/flagr/releases/tag/1.1.19
• https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization

No related operational record is retained in the current change model.