PT-2026-65619 · Openhole · Openhole

CVE-2026-54650 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openhole versions prior to 0.1.2

Description The openhole-server in internal/server/public proxy.go forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of preserving the original request target. This behavior allowed percent-encoded dot segments %2e and separators %2f to be decoded as ../ and / before reaching the local service, bypassing Go's ServeMux protections. An unauthenticated remote attacker could exploit this to perform path traversal, enabling the reading of files outside the published web root on tunneled local services that do not resolve paths without canonicalization. Additionally, encoded slashes could be used to bypass path-based access controls.

Recommendations Update openhole-server and the openhole CLI to version 0.1.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-54650

GHSA-FH2F-XFXC-Q9CC

Affected Products

Openhole

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54650 · Security Note
• https://osv.dev/vulnerability/GHSA-fh2f-xfxc-q9cc · Vendor Advisory
• https://github.com/bablilayoub/openhole/commit/a28c27adde2a7ed0c347b730c8707208c0f78ed3 · Note
• https://github.com/bablilayoub/openhole/security/advisories/GHSA-fh2f-xfxc-q9cc · Note
• https://github.com/bablilayoub/openhole/releases/tag/v0.1.2 · Note
• https://github.com/bablilayoub/openhole · Note