CVE-2026-122132
Description
A flaw was found in go-chi. This open redirect vulnerability allows a remote attacker to redirect users to arbitrary external websites by enticing them to follow a specially crafted link containing an encoded tab character in the request path. When the RedirectSlashes middleware issues a redirection response, web browsers strip the tab character and interpret the destination as an external host, potentially exposing victims to phishing or credential theft.
Statement
This vulnerability is rated as Moderate by Red Hat because exploitation depends on tricking a user into navigating to a malicious link, and the blast radius is restricted to client-side redirection rather than direct server or data compromise. Exposure only arises in Go microservices that intentionally enable the optional slash-redirection middleware during router setup. Applications that do not activate this routing handler or that filter request paths at an upstream proxy remain unaffected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
The user may be redirected to an untrusted page that contains malware which may then compromise the user's system. In some cases, an open redirect can also enable the immediate download of a file without the user's permission, because the redirection to an external site may lead to endpoints on those sites that automatically trigger a download action ("drive-by download" [REF-1478]). This will expose the user to extensive risk. The user's interaction with the web server may also be compromised if the malware conducts keylogging or other attacks that steal credentials, personally identifiable information (PII), or other important data.
Access Control,Confidentiality,Other
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Other
By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam. The user may be subjected to phishing attacks by being redirected to an untrusted page. The phishing attack may point to an attacker controlled web page that appears to be a trusted web site. The phishers may then steal the user's credentials and then use these credentials to access the legitimate web site. Because the server name in the modified link is identical to the original site, phishing attempts can appear more trustworthy.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
