Vulnerabilities

TI-2026-74113 CVE-2026-110619 · GHSA-8584-2qgx-4xpf

Missing authentication exposes pprof debug endpoints in frp

MEDIUM 61

frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authent…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00781 Published 2026-10-14 No fix listed CWE-306

TI-2026-51654 CVE-2026-73564 · GHSA-26gq-p25f-99cp

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

HIGH 77

frp is a fast reverse proxy.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-08-13 Fixed in 0.70.1 CWE-129

TI-2026-29566 CVE-2026-40910 · GHSA-pq96-pwvg-vrr9

frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control

HIGH 72

frp is a fast reverse proxy.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00269 Published 2026-04-21 Fixed in 0.68.1 CWE-287

Vulnerabilities

Filters

Missing authentication exposes pprof debug endpoints in frp

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control