CVE Alert: CVE-2026-88829 – Red Hat

A flaw was found in BusyBox httpd’s reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

Treat this as a high-priority exposure review for any deployment using path-based proxy restrictions; exploitation status cannot be confirmed because KEV, SSVC, PoC and EPSS data were not provided.

### **Why this matters**

A remote attacker may reach backend routes that administrators intended to keep unavailable through the proxy, potentially accessing sensitive functions or altering data. The main business risk is unauthorised access to internal application capabilities; impact depends on what the backend exposes and its own controls.

### **Most likely attack path**

The attacker needs network access to the proxy, but no account or user interaction, and the attack has no stated complexity barrier. A compromised path boundary could expose other backend routes, though movement beyond that backend is not established by the available information.

### **Who is most exposed**

Prioritise embedded or containerised deployments where a lightweight web server proxies selected URL prefixes to internal services. Exposure is greatest where those prefix rules are the only protection for sensitive backend paths.

### **Detection ideas**

Alert on pipelined requests and multiple requests sent over one client connection.

Compare inbound paths with paths observed at the backend; flag unexpected routes.

Review proxy and backend logs for access to normally private endpoints.

Check for unusual backend actions following requests through the proxy.

### **Mitigation and prioritisation**

Confirm the affected component and apply the vendor’s fixed build when available; verify the package source and remediation status.

Until patched, remove unnecessary proxy rules or place a fully featured reverse proxy in front.

Do not rely on path-prefix rules alone; enforce access controls at the backend.

Test pipelining behaviour and backend routes in staging before rollout; coordinate changes with service owners.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.