CVE-2026-34581: goshs Authentication Bypass Vulnerability

CVE-2026-34581 Overview

CVE-2026-34581 is an authentication bypass vulnerability in goshs, a SimpleHTTPServer written in Go. The flaw exists in versions 1.1.0 through versions prior to 2.0.0-beta.2, where the Share Token feature can be exploited to bypass restricted file download limitations and gain access to all goshs functionalities, including remote code execution capabilities.

Critical Impact

Attackers can bypass Share Token access controls to achieve full server functionality access, including arbitrary code execution on the target system.

Affected Products

• goshs versions 1.1.0 to < 2.0.0-beta.2

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-34581 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34581

Vulnerability Analysis

This vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The Share Token feature in goshs was designed to provide restricted access for limited file downloads. However, the implementation failed to properly enforce access controls across all server endpoints, allowing token-authenticated users to access privileged functionalities that should have been restricted.

The flaw enables attackers with a valid Share Token to bypass the intended access restrictions and invoke sensitive server operations. Most critically, this includes access to code execution capabilities that were meant to be protected from token-based access. The network-based attack vector requires user interaction, but once exploited, can lead to high confidentiality and integrity impacts on the affected system.

Root Cause

The root cause stems from insufficient authorization checks in the HTTP request handler. When processing requests with Share Token authentication, the server did not validate whether the requested endpoint should be accessible to token-authenticated users. Multiple sensitive endpoints including SMTP attachment handling (smtp), system information disclosure (goshs-info), directory creation (mkdir), and WebSocket connections (ws) lacked proper token access validation, allowing authenticated token users to access these privileged functions.

Attack Vector

The attack is network-based and exploits the authorization bypass in the Share Token mechanism. An attacker with a valid Share Token can craft HTTP requests to sensitive endpoints by appending the token parameter while accessing protected server functionalities. Since the early parameter handling in the request router did not verify token-based restrictions before routing to sensitive handlers, all goshs features become accessible regardless of the intended Share Token limitations.

// Vulnerable code pattern - missing token access validation
func (fs *FileServer) earlyBreakParameters(w http.ResponseWriter, req *http.Request) bool {
	if _, ok := req.URL.Query()["smtp"]; ok {
		// Missing: denyForTokenAccess check
		fs.handleSMTPAttachment(w, req)
		return true
	}
	if _, ok := req.URL.Query()["goshs-info"]; ok {
		// Missing: denyForTokenAccess check
		fs.handleInfo(w)
		return true
	}
	if _, ok := req.URL.Query()["mkdir"]; ok {
		// Missing: denyForTokenAccess check
		fs.handleMkdir(w, req)
		return true
	}
	if _, ok := req.URL.Query()["ws"]; ok {
		// Missing: denyForTokenAccess check
		fs.socket(w, req)
		return true
	}
}

Source: GitHub Commit Update

Detection Methods for CVE-2026-34581

Indicators of Compromise

• HTTP requests containing both token= parameter and sensitive query parameters (smtp, goshs-info, mkdir, ws)
• Unusual access patterns to goshs administrative endpoints from Share Token authenticated sessions
• WebSocket connection attempts or directory creation operations from token-authenticated users

Detection Strategies

• Monitor HTTP access logs for requests combining Share Token authentication with privileged endpoint access
• Implement network-based detection rules to flag requests with token= parameter accessing administrative endpoints
• Review goshs logs for unauthorized operations executed during token-authenticated sessions

Monitoring Recommendations

• Deploy web application firewall (WAF) rules to detect and block exploitation attempts targeting the authentication bypass
• Enable detailed logging for all goshs endpoints to capture potential exploitation attempts
• Set up alerts for any code execution or system modification operations triggered by token-authenticated users

How to Mitigate CVE-2026-34581

Immediate Actions Required

• Upgrade goshs to version 2.0.0-beta.2 or later immediately
• If immediate upgrade is not possible, disable the Share Token feature until patching is complete
• Audit logs for any evidence of exploitation prior to patching
• Review and restrict network access to goshs instances to trusted users only

Patch Information

The vulnerability has been patched in goshs version 2.0.0-beta.2. The fix implements a new denyForTokenAccess() function that validates whether a request is using token-based authentication and denies access to privileged endpoints accordingly. The patch ensures that all sensitive handler functions perform token access validation before processing requests.

The security fix can be reviewed in the GitHub Security Advisory GHSA-jgfx-74g2-9r6g and the patched release v2.0.0-beta.2.

Workarounds

• Disable Share Token functionality entirely if upgrading is not immediately feasible
• Implement network-level access controls to restrict goshs access to trusted IP addresses only
• Place goshs behind a reverse proxy with additional authentication requirements
• Monitor and audit all token-authenticated access until the patch can be applied

// Patched code - token access validation added
func denyForTokenAccess(w http.ResponseWriter, r *http.Request) bool {
	if r.URL.Query().Get("token") != "" {
		http.Error(w, "Forbidden", http.StatusForbidden)
		return true
	}
	return false
}

Source: GitHub Commit Update