CVE-2026-2836 describes a cache poisoning vulnerability in the Pingora HTTP proxy framework's default cache key implementation, affecting users who relied on this feature. The issue stems from the cache key only using the URI path, omitting crucial factors like the host header, which can lead to cross-origin responses being served improperly. This high-severity vulnerability (CVSS 8.4) allows for cross-tenant data leakage and cache poisoning attacks, with a low attack complexity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.8.0CPE matchmatch criteria | cpe:2.3:a:cloudflare:pingora:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.