CVE-2026-48154: GoRest Race Condition Vulnerability

CVE-2026-48154 Overview

CVE-2026-48154 is a race condition vulnerability in GoRest, a Golang starter kit built on the Gin framework for prototyping RESTful APIs. Versions prior to 1.12.2 contain an unsynchronized package-level map named InMemorySecret2FA used to store two-factor authentication (2FA) secrets. HTTP handlers in handler/login.go and handler/twoFA.go read and write to this map concurrently. Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error. An attacker can repeatedly trigger this condition to crash the process on demand, producing a high availability impact with no confidentiality or integrity consequences. The issue is fixed in version 1.12.2.

Critical Impact
Unauthenticated network attackers can crash GoRest-based API processes on demand by racing 2FA endpoints, resulting in repeatable denial of service.

Affected Products

GoRest (pilinux/gorest) versions prior to 1.12.2
Applications embedding GoRest handlers handler/login.go and handler/twoFA.go
Golang services using the vulnerable model.InMemorySecret2FA package-level map

Discovery Timeline

2026-08-04 - CVE-2026-48154 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-48154

Vulnerability Analysis

The defect is a classic concurrent map access race [CWE-362]. GoRest stores pending 2FA secrets in a package-level Go map, model.InMemorySecret2FA, without any synchronization primitive. Multiple Gin HTTP handlers access this map on separate goroutines during login and 2FA verification flows.

Go's runtime detects concurrent map writes and terminates the process with a fatal error rather than panicking recoverably. An attacker sending parallel requests to the affected endpoints can reliably trigger this condition, killing the API server. The impact is bounded to availability; no secret material is leaked or altered.

Root Cause

The root cause is the use of a raw map[string]Secret2FA as shared mutable state across HTTP request goroutines. The map lacks a sync.Mutex, sync.RWMutex, or sync.Map wrapper. Any interleaved read and write, or two concurrent writes, invokes the Go runtime's concurrent map access detector, which aborts the process.

Attack Vector

Exploitation requires network access to endpoints that touch the 2FA workflow, but no authentication or user interaction. The attacker issues many concurrent requests against login and 2FA handlers to force the runtime to observe simultaneous map operations. Attack complexity is elevated because the attacker must interleave requests to hit the race window, but success is repeatable once the timing is established.

// Patch excerpt: database/model/twoFA.go
 package model
 
 import (
+	"sync"
 	"time"
 
 	"gorm.io/gorm"

// Patch excerpt: handler/login.go
 				// save the hashed pass (key) in memory for OTP validation step
 				data2FA := model.Secret2FA{}
 				data2FA.PassHash = key
-				model.InMemorySecret2FA[claims.AuthID] = data2FA
+				model.InMemorySecret2FA.Set(claims.AuthID, data2FA)

Source: GitHub Commit 117ff55. The fix introduces the sync package and replaces raw map indexing with a Set method that serializes access.

Detection Methods for CVE-2026-48154

Indicators of Compromise

Sudden process termination of the GoRest binary with fatal error: concurrent map read and map write or concurrent map writes in stderr or container logs.
Bursts of parallel requests to /login and 2FA verification endpoints from a single source IP or narrow address range shortly before crashes.
Repeated automatic restarts of the GoRest service by an orchestrator such as systemd or Kubernetes without an accompanying deployment change.

Detection Strategies

Alert on the exact Go runtime string fatal error: concurrent map appearing in application logs.
Correlate HTTP access logs with process exit events to identify request patterns preceding crashes.
Baseline request rates against 2FA endpoints and flag deviations that coincide with SIGABRT exits.

Monitoring Recommendations

Forward stdout and stderr from GoRest containers to a centralized log platform and index on fatal error strings.
Track process restart counts per pod or service instance and alert on elevated restart velocity.
Monitor HTTP 5xx spikes and connection resets on login and 2FA routes.

How to Mitigate CVE-2026-48154

Immediate Actions Required

Upgrade GoRest to version 1.12.2 or later, which serializes access to InMemorySecret2FA.
Audit forks and downstream applications that copied handler/login.go or handler/twoFA.go for the same unsynchronized map pattern.
Place rate limits and per-IP concurrency caps in front of authentication endpoints to reduce race exploitability until patched.

Patch Information

The fix is delivered in GoRest 1.12.2 via Pull Request #391 and commit 117ff55fc21b47442da07c44c30b403af2da407b. The advisory is published as GHSA-cpwg-x64r-rgwg. The patch imports sync in database/model/twoFA.go and replaces direct map assignment with a Set method that acquires a mutex.

Workarounds

Front the GoRest service with a reverse proxy that enforces strict concurrency limits on /login and 2FA routes.
Deploy GoRest behind a process supervisor with rapid restart to reduce downtime, while accepting that crashes remain triggerable.
If maintaining a local fork, wrap access to model.InMemorySecret2FA with a sync.RWMutex or migrate to sync.Map as an interim change.

bash

# Update GoRest dependency to the fixed release
go get github.com/pilinux/gorest@v1.12.2
go mod tidy

# Verify resolved version
go list -m github.com/pilinux/gorest