CVE-2026-33768

Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel's platform-level path restrictions entirely. The override preserves the original HTTP method and body, so this isn't limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking /admin/* does nothing when the request comes in as POST /api/health?x_astro_path=/admin/delete-user. This issue has been patched in version 10.0.2.

• CWE-441
• CWE-862

• https://github.com/withastro/astro/commit/335a204161f5a7293c128db570901d4f8639c6edPatch
• https://github.com/withastro/astro/pull/15959Issue Tracking
• https://github.com/withastro/astro/releases/tag/%40astrojs%2Fvercel%4010.0.2Release Notes
• https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84Exploit, Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33762go-git is an extensible git implementation library written i…2.8
• CVE-2026-33763WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-33764WWBN AVideo is an open source video platform. In versions up…4.3
• CVE-2026-33765Pi-hole Admin Interface is a web interface for managing Pi-h…9.8
• CVE-2026-33766WWBN AVideo is an open source video platform. In versions up…6.5
• CVE-2026-33767WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33769Astro is a web framework. From version 2.10.10 to before ver…5.3
• CVE-2026-3377A vulnerability was detected in Tenda F453 1.0.0.3. Affected…8.8
• CVE-2026-33770WWBN AVideo is an open source video platform. In versions up…9.8
• CVE-2026-33771A Weak Password Requirements vulnerability in the password m…8.1
• CVE-2026-33773An Incorrect Initialization of Resource vulnerability in the…6.9
• CVE-2026-33774An Improper Check for Unusual or Exceptional Conditions vuln…5.3