CVE-2026-30246 — Fiber is a web framework for Go. In

title: CVE-2026-30246 - Fiber Cache Middleware Response Mix-up
id: scw-2026-05-05-ai-1
status: experimental
level: medium
description: |
  This rule detects potential exploitation of CVE-2026-30246 in the Fiber web framework. The vulnerability arises when the cache middleware uses only the request path and not the query string for cache keys. This rule specifically looks for requests to the root path ('/') with query parameters, which could lead to response mix-ups if an attacker crafts requests to receive cached data intended for a different query string. This is a direct indicator of the cache poisoning vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-30246/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri: 
          - '/'
      cs-uri-query: 
          - '?param1=value1&param2=value2'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse