A flaw in the NewServer function of go‑kratos’ HTTP transport allows a remote actor to manipulate arguments passed to the http.DefaultServeMux fallback handler. This mis‑routing is a classic confused deputy vulnerability (CWE‑441 and CWE‑444) that can cause the server to perform actions on behalf of a user with higher privileges than intended, potentially leading to unauthorized access or execution of code with elevated rights.

The vulnerability affects the go‑kratos kratos framework up to and including version 2.9.2. No other versions are known to be impacted.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation, although a public exploit has been released. The flaw can be triggered remotely via network access to the HTTP service, but it does not require local privilege or user interaction. The issue is not listed in CISA’s KEV catalog. Given the public nature of the exploit, the risk remains significant for systems that have not yet applied the patch.