Cyber Resilience

CVE-2026-6993

Published
25 April 2026
Modified
27 April 2026
CVSS Score v4 5.5
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 24th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-6993 is a medium-severity Confused Deputy (CWE-441) vulnerability. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The…

more

exploit has been released to the public and may be used for attacks. The patch is identified as 0284a5bcf92b5a7ee015300ce3051baf7ae4718d. Applying a patch is advised to resolve this issue.

CWE(s)
CWE-441

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1090 Proxy Command And Control
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
attack.mitre.org →
Why these techniques?

CWE-441 confused deputy in public HTTP handler enables remote exploitation of the server (T1190) and abuse as unintended proxy/intermediary (T1090).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1090 Proxy Command And Controlconfidence: MEDIUM
CWE-441 flaw in HTTP fallback handler enables the server to act as an unintended proxy/intermediary for remote attackers.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-42933Shared CWE-441
CVE-2026-16158Shared CWE-441
CVE-2025-66415Shared CWE-441
CVE-2025-68944Shared CWE-441
CVE-2026-24471Shared CWE-441
CVE-2026-39906Shared CWE-441
CVE-2026-55430Shared CWE-441
CVE-2026-0107Shared CWE-441
CVE-2024-30128Shared CWE-441
CVE-2025-48570Shared CWE-441

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-4 Information Flow Enforcement
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.2.1
  • V3.5.1
  • V3.5.3
  • V3.5.8

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces explicit access decisions on HTTP requests instead of allowing fallback to the unintended DefaultServeMux handler.

AC-4 Information Flow Enforcement good match
prevent

Controls information flows through the HTTP transport layer to block confused-deputy proxying via the vulnerable NewServer path.

CM-7 Least Functionality partial match
prevent

Disables or restricts unneeded default mux functionality that the flaw exposes as an unintended intermediary.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 mostly match
prevents

Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.

PR.AA-05 partial match
prevents

Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
prevents

Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.

A.5.16 Identity management partial match
prevents

Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.

A.5.18 Access rights partial match
degrades

Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.

A.8.2 Privileged access rights partial match
degrades

Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.

A.8.20 Networks security partial match
degrades

Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.

A.8.25 Secure development life cycle partial match
prevents

Secure-SDLC practices include design reviews that detect and eliminate confused-deputy proxy patterns before deployment.

References