CVE-2026-88829: BusyBox httpd Reverse Proxy Vulnerability

Redpacketsecurity

CVE-2026-88829: BusyBox httpd Reverse Proxy Vulnerability

First seen 15 Oct 2026, 01:38 UTC • •57.8

Article Content

1 / 3

Browse articles

ThreatCluster •October 15, 2026 at 01:39 UTC

•CVE-2026-88829 allows unauthorized backend access via pipelined requests.
•Red Hat's Fedora is affected; RHEL does not include BusyBox by default.
•Immediate action is recommended to enhance access controls and proxy configurations.

A flaw in BusyBox httpd's reverse proxy feature allows attackers to bypass path restrictions by sending pipelined requests. This vulnerability, identified as CVE-2026-88829, affects systems using path-based proxy rules, particularly in embedded or containerized deployments. The flaw enables unauthorized access to backend server paths that should remain restricted. Red Hat has noted that while Fedora is affected, RHEL does not ship BusyBox as a standard package. The CVSS score for this vulnerability is 7.2, indicating a high severity. No proof-of-concept or has been confirmed. Administrators are advised to implement additional access controls and consider using a full reverse proxy. The flaw was published on October 14, 2026, and is currently under review for impact analysis.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-14

CVE-2026-88829 published

The vulnerability in BusyBox httpd's reverse proxy feature was disclosed with a CVSS score of 7.2.

access.redhat.com

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Vulnerability (1)

CVE-2026-88829

Weakness (1)

CWE-22 - Path Traversal

Tool (1)

BusyBox

Relationships

BusyBox exploits CVE-2026-88829
CVE-2026-88829 related to Data Breach
CVE-2026-88829 related to CWE-22 - Path Traversal

Following this threat?

Track CVE-2026-88829 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which systems are affected by CVE-2026-88829?

The vulnerability primarily affects Fedora systems using BusyBox with reverse proxy rules enabled.

What should I do to mitigate this vulnerability?

Remove unnecessary proxy rules, enforce access controls at the backend, and consider using a full-featured reverse proxy.

Is there any active exploitation of this vulnerability?

No, there is currently no confirmed active exploitation or proof-of-concept code available.

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…