CVE-2026-1010 – WebSocket Connection Smuggling

Overview

A reverse proxy and backend disagree on how to parse an HTTP request with a malformed WebSocket upgrade header. The proxy treats it as one request, while the backend interprets it as two, allowing an attacker to smuggle a hidden request. This can lead to cache poisoning or access control bypass.

Vulnerability Details

• Type: Connection Smuggling / Request Splitting
• Impact: Unauthorized access to internal endpoints, cache poisoning.
• Root Cause: The proxy forwards the request without normalizing it, and the backend’s WebSocket detection triggers on the Upgrade header and then processes subsequent data as a new HTTP request.

Exploit Demonstration

1. Start the proxy and backend:
   root@kitploit:~

   python reverse_proxy.py &   # port 8080
   python websocket_backend.py & # port 8081