CVE-2026-34206

Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet. Prior to version 1.12.2, a reflected cross-site scripting (XSS) vulnerability exists in github.com/libops/captcha-protect. The challenge page accepted a client-supplied destination value and rendered it into HTML using Go's text/template. Because text/template does not perform contextual HTML escaping, an attacker could supply a crafted destination value that breaks out of the hidden input attribute and injects arbitrary script into the challenge page. This issue has been patched in version 1.12.2.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/libops/captcha-protect/commit/eef6211ecd1147273be484d913b81c68c0bd8d3f	Patch
https://github.com/libops/captcha-protect/releases/tag/v1.12.2	Product Release Notes
https://github.com/libops/captcha-protect/security/advisories/GHSA-ph62-4j5g-2q4r	Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:libops:captcha_protect:*:*:*:*:*:traefik:*:*

History

No history.

Information

Published : 2026-03-31 20:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-34206

Mitre link : CVE-2026-34206

CVE.ORG link : CVE-2026-34206

JSON object : View

Products Affected

libops

captcha_protect

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-34206", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34206", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T18:40:57.202868Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "libops", "product": "captcha-protect", "versions": [{"status": "affected", "version": "< 1.12.2"}]}]}], "published": "2026-03-31T20:16:28.830", "references": [{"url": "https://github.com/libops/captcha-protect/commit/eef6211ecd1147273be484d913b81c68c0bd8d3f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/libops/captcha-protect/releases/tag/v1.12.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/libops/captcha-protect/security/advisories/GHSA-ph62-4j5g-2q4r", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet. Prior to version 1.12.2, a reflected cross-site scripting (XSS) vulnerability exists in github.com/libops/captcha-protect. The challenge page accepted a client-supplied destination value and rendered it into HTML using Go's text/template. Because text/template does not perform contextual HTML escaping, an attacker could supply a crafted destination value that breaks out of the hidden input attribute and injects arbitrary script into the challenge page. This issue has been patched in version 1.12.2."}, {"lang": "es", "value": "Captcha Protect es un middleware de Traefik para a\u00f1adir un desaf\u00edo anti-bot a IPs individuales en una subred cuando se detectan picos de tr\u00e1fico desde esa subred. Antes de la versi\u00f3n 1.12.2, existe una vulnerabilidad de cross-site scripting (XSS) reflejado en github.com/libops/captcha-protect. La p\u00e1gina de desaf\u00edo aceptaba un valor de destino proporcionado por el cliente y lo renderizaba en HTML usando el text/template de Go. Debido a que text/template no realiza el escape contextual de HTML, un atacante podr\u00eda proporcionar un valor de destino manipulado que escapa del atributo de entrada oculto e inyecta script arbitrario en la p\u00e1gina de desaf\u00edo. Este problema ha sido parcheado en la versi\u00f3n 1.12.2."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libops:captcha_protect:*:*:*:*:*:traefik:*:*", "vulnerable": true, "matchCriteriaId": "0521B194-E67A-4D35-B160-9410AE9668AA", "versionEndExcluding": "1.12.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}