CVE-2026-43505 — Prosody Vulnerability

title: CVE-2026-43505: Unauthenticated Traffic Relay via mod_proxy65
id: scw-2026-05-01-ai-1
status: experimental
level: critical
description: |
  This rule detects potential exploitation of CVE-2026-43505. The vulnerability allows relaying of unauthenticated traffic when mod_proxy65 is enabled in Prosody. This detection looks for traffic directed to the standard XMPP port (5222) that appears to be interacting with the proxy65 module, indicated by 'proxy65' in the query string, and returning a successful status code (200), suggesting successful relaying of traffic.
author: SCW Feed Engine (AI-generated)
date: 2026-05-01
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-43505/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: proxy
detection:
  selection:
      dst_port:
          - 5222
      cs-uri-query|contains:
          - 'proxy65'
      sc-status:
          - 200
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse