CVE-2026-43644 is a reflected cross-site scripting vulnerability in the podinfo application (up to version 6.11.2). The issue exists in the /echo and /api/echo endpoints where the server echoes the request body directly in the HTTP response without setting explicit Content-Type or X-Content-Type-Options headers. Due to Go's content type detection, the response is served as text/html, enabling execution of injected script payloads in the context of the podinfo origin. This can be exploited by attackers who craft malicious cross-origin HTML pages with auto-submitting forms containing the payload, leading to reflected XSS when a victim visits the attacker's page.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the podinfo origin for users who visit a malicious page crafted by the attacker. This can lead to typical reflected XSS impacts such as session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction (visiting a malicious page) and does not involve privilege escalation or direct system compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block suspicious requests to the /echo and /api/echo endpoints. Additionally, configuring reverse proxies or application servers to set explicit Content-Type and X-Content-Type-Options headers may help mitigate the risk. Avoid exposing these endpoints publicly if possible.