A missing authentication check in the frp server allows remote attackers to call the /debug/pprof/ endpoints without credentials. These endpoints expose command‑line arguments, goroutine stacks, heap profiles, and CPU profiling data, providing detailed insight into the server’s internal state. The vulnerability is classified as CWE‑306 and does not enable code execution or privilege escalation on its own, but the leaked information can facilitate further attacks or aid in reconnaissance.

The issue affects the frp product from fatedier, versions 0.41.0 through 0.71.1. Any deployment of these releases is susceptible when the default HTTP server exposes the pprof routes in the root multiplexer.

The CVSS score of 6.3 indicates moderate severity. Exploitation requires no credentials and can be performed by any host able to reach the frp server’s dashboard or frpc admin listener. The EPSS score is 0.00781 (<1%), indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can remotely retrieve sensitive debugging information by issuing HTTP requests to /debug/pprof/ endpoints over the network.