CVE-2026-54650: Remote Path Traversal in openhole-server and openhole CLI Client

The openhole suite is an open-source utility designed to expose local development servers to the public internet. This exposure is accomplished by routing traffic through a public-facing gateway to an internal agent running on the developer's local system.

A critical vulnerability exists within openhole-server version 0.1.1 and earlier, classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The core issue lies in the public proxy component, which fails to preserve raw, percent-encoded request paths when forwarding them to the local agent.

This behavior allows a remote attacker to perform a directory traversal attack against the underlying local services. By submitting specifically crafted requests with percent-encoded directory traversal sequences, the attacker can access restricted resources residing outside the intended document root of the local application.

To understand the root cause of CVE-2026-54650, one must analyze how Go handles URL parsing in the standard net/http library. When the standard library parses an incoming HTTP request, it populates the r.URL structure with fields that interpret percent-encoding differently.

The r.URL.Path property is designed to represent the decoded or unescaped path string. Consequently, any percent-encoded dot segments (%2e%2e representing ..) and path separators (%2f representing /) are automatically converted back into their literal characters before the handler processes the request.

In internal/server/public_proxy.go, the application assigned the incoming request path directly from r.URL.Path. This architectural choice resulted in the immediate expansion of all percent-encoded directory traversal segments inside the proxy server context. The proxy server subsequently wrapped this normalized path into a JSON-based protocol control message and dispatched it down the tunnel stream.

An examination of the vulnerable codebase in internal/client/local_proxy.go shows how the client reconstructed the destination URL. The client utilized string formatting with fmt.Sprintf to merge the local host, port, and the decoded path directly into a target string.

// Vulnerable implementation
url := fmt.Sprintf("http://%s:%d%s", host, port, req.Path)

This string formatting step meant that if req.Path contained the literal string /../../etc/passwd, the client requested that exact URL from the local server. The Go HTTP client then transmitted a literal, canonicalized directory traversal request to the local backend service.

The remediation introduced in version 0.1.2 modifies both the server and client components. The server now calls r.URL.EscapedPath(), ensuring that percent-encoded structures remain encoded during transit. The client now properly instantiates a url.URL struct to parse the path safely.

// Patched client implementation
target := &url.URL{
	Scheme: "http",
	Host:   fmt.Sprintf("%s:%d", host, port),
}
httpReq, err := http.NewRequest(req.Method, target.String(), bytes.NewReader(body))
// ...
path := req.Path
if path == "" {
	path = "/"
}
httpReq.URL.RawPath = path
httpReq.URL.Path, err = url.PathUnescape(path)
if err != nil {
	httpReq.URL.Path = path
}

This structured assignment forces Go's HTTP client to output the exact original, percent-encoded string to the downstream local backend service, delegating path canonicalization to the local server instead of validating traversal at the proxy client boundary.

An attacker begins by identifying a publicly exposed openhole tunnel, represented by a domain such as https://temp-tunnel.openhole.dev. Since the endpoint is accessible over the public internet, no authentication is required to interact with the server interface.

The attacker crafts a custom HTTP GET request targeting the public endpoint. The request includes percent-encoded directory traversal indicators aimed at sensitive operating system files or local configuration assets.

GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
Host: temp-tunnel.openhole.dev
Connection: close

When the vulnerable public-facing proxy receives this request, it decodes the URI, generating a literal string /../../../../etc/passwd. The proxy encapsulates this string in a WebSocket-based request payload and forwards it down the active tunnel. The local CLI client translates this payload into an active localhost request, triggering file retrieval on the developer's workstation.

The primary impact of CVE-2026-54650 is unauthorized read-access to arbitrary files on the local workstation hosting the openhole client. This includes access to source code, environment variables, localized databases, and critical system files.

The CVSS v3.1 base score of 8.6 reflects high severity. Significantly, the Scope metric is evaluated as Changed (S:C). While the vulnerability resides in the internet-facing proxy server, the actual security impact occurs entirely within the security domain of the internal localhost development environment.

Because developers frequently run local databases and backend components with minimized security configurations, exposing these services via an openhole tunnel bypasses perimeter defenses. The vulnerability allows a remote attacker to gain direct access to assets that were otherwise assumed to be shielded behind firewalls or restricted to localized loopback interfaces.

Remediation requires upgrading both the openhole-server and the local openhole CLI agent to version 0.1.2 or higher. The updated software implements rigorous URL parameter formatting, ensuring that raw, percent-encoded values are preserved during routing.

For systems where immediate upgrades are impossible, developers should implement temporary workarounds. These include restricting access to the public proxy via firewall rules or IP address whitelisting, limiting exposure only to authorized external clients.

Additionally, developers should ensure that local development applications do not run with root or administrative privileges. Minimizing system-level access prevents traversal attacks from retrieving highly privileged operating system components if a local application is exposed to malicious input routing.