# CVE-2026-68548: Algernon URL-prefix authorization bypass on case-insensitive filesystems

Source: https://junglewise.ai/threats/cve-2026-68548-algernon-is-a-small-self-contained-pure-go-web-server-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-68548 · Severity: critical · CVSS 9.4 · Published 2026-11-12

Algernon is a lightweight Go web server with a permission system that protects administrative paths like /admin, /repo, and /data. On Windows and macOS systems, attackers can bypass this protection by requesting URLs with different letter casing (e.g., /Admin instead of /admin), allowing unauthenticated access to protected files and execution of protected Lua scripts.

Technologies: [Xyproto Algernon](https://junglewise.ai/threats/technologies/algernon). Vendors: [Xyproto](https://junglewise.ai/threats/vendors/xyproto).

## Quick answers

**Is CVE-2026-68548 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68548 being exploited in the wild.

**How severe is CVE-2026-68548?** Critical severity, with a CVSS score of 9.4, published 12 November 2026.

**Which products and versions are affected?** Xyproto Algernon prior to 1.17.10.

**Is there a fix for CVE-2026-68548?** A patch was published on 2026-07-04. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-68548 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-68548?** Check whether you run Xyproto Algernon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from case-sensitive string matching in the Rejected() authorization gate while the filesystem resolution is case-insensitive. An attacker sends a request with mixed-case path like /Admin/secret.lua; the permission check uses strings.HasPrefix() without normalization, so "/Admin" does not match the protected prefix "/admin" and falls through to public acceptance. The same path is then passed to the filesystem layer, which resolves it to the real admin/secret.lua on case-insensitive NTFS, APFS, or HFS+ filesystems, bypassing authorization entirely.

## Affected products

- xyproto Algernon prior to 1.17.10

## Timeline

- 2026-07-04: disclosed
- 2026-07-04: patched

## References

- [https://github.com/xyproto/algernon/releases/tag/v1.17.10](https://github.com/xyproto/algernon/releases/tag/v1.17.10)
- [https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx](https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx)

## Related threats

- [xyproto Algernon source disclosure via NTFS filename manipulation](https://junglewise.ai/threats/cve-2026-52792-xyproto-algernon-source-disclosure-via-ntfs-filename-manipulation)
- [xyproto Algernon path traversal and RCE via Host header](https://junglewise.ai/threats/cve-2026-48126-xyproto-algernon-path-traversal-and-rce-via-host-header)
- [xyproto Algernon permissive CORS policy in SSE event server](https://junglewise.ai/threats/cve-2026-46431-xyproto-algernon-permissive-cors-policy-in-sse-event-server)
- [xyproto Algernon information disclosure in single-file mode](https://junglewise.ai/threats/cve-2026-45728-xyproto-algernon-information-disclosure-in-single-file-mode)
- [xyproto Algernon remote code execution via handler.lua path traversal](https://junglewise.ai/threats/cve-2026-45721-xyproto-algernon-remote-code-execution-via-handler-lua-path)