Is CVE-2026-30246 actively exploited?

No active exploitation of CVE-2026-30246 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-30246 be exploited remotely?

Yes. CVE-2026-30246 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-30246?

CVE-2026-30246 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-30246

MEDIUM

CVE-2026-30246

CWE-436Published: May 5, 2026· Updated: May 7, 2026

6.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.6th

Official Description

Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0.

NVD Source

Technical Analysis

CVE-2026-30246 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.