CVE-2026-34206

Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet. Prior to version 1.12.2, a reflected cross-site scripting (XSS) vulnerability exists in github.com/libops/captcha-protect. The challenge page accepted a client-supplied destination value and rendered it into HTML using Go's text/template. Because text/template does not perform contextual HTML escaping, an attacker could supply a crafted destination value that breaks out of the hidden input attribute and injects arbitrary script into the challenge page. This issue has been patched in version 1.12.2.

• CWE-79

• https://github.com/libops/captcha-protect/commit/eef6211ecd1147273be484d913b81c68c0bd8d3fPatch
• https://github.com/libops/captcha-protect/releases/tag/v1.12.2Product, Release Notes
• https://github.com/libops/captcha-protect/security/advisories/GHSA-ph62-4j5g-2q4rMitigation, Patch, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34198Coolify is an open-source and self-hostable tool for managin…5.3
• CVE-2026-34200Nhost is an open source Firebase alternative with GraphQL. P…7.5
• CVE-2026-34202ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-34203Nautobot is a Network Source of Truth and Network Automation…4.3
• CVE-2026-34204MinIO is a high-performance object storage system. Prior to …7.1
• CVE-2026-34205Home Assistant is open source home automation software that …9.6
• CVE-2026-34207TypeBot is a chatbot builder tool. In versions prior to 3.16…7.6
• CVE-2026-34208SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…10
• CVE-2026-34209mppx is a TypeScript interface for machine payments protocol…7.5
• CVE-2026-34210mppx is a TypeScript interface for machine payments protocol…8.1
• CVE-2026-34211SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…7.5
• CVE-2026-34212Docmost is open-source collaborative wiki and documentation …5.4