CVE-2026-72001 Overview
CVE-2026-72001 is an authentication bypass vulnerability in Pangolin versions before 1.22.0. The flaw resides in the share-link authentication endpoint, which accepts an attacker-controlled URL parameter and omits the expected resource identifier from the token verification call. An unauthenticated attacker holding a single valid share link can authenticate against any protected resource, including resources belonging to different organizations. The bypass circumvents all configured authentication methods, including single sign-on (SSO), resource passwords, PIN codes, email allowlists, and header authentication. The vulnerability is tracked under [CWE-639] Authorization Bypass Through User-Controlled Key.
Critical Impact
Attackers with one valid share link can access any protected resource across organizations, defeating SSO, passwords, PINs, and allowlists.
Affected Products
- Pangolin versions prior to 1.22.0
- Pangolin share-link authentication endpoint
- Multi-tenant Pangolin deployments hosting resources across organizations
Discovery Timeline
- 2026-08-31 - CVE-2026-72001 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-72001
Vulnerability Analysis
Pangolin exposes a share-link authentication endpoint that validates access tokens against specific protected resources. The endpoint accepts a URL parameter that identifies the resource being requested. In vulnerable versions, the server passes the attacker-supplied parameter into the token verification routine without binding the check to the resource actually being accessed. The verification call omits the expected resource identifier, so the token is validated in isolation rather than against the resource under request.
Any valid share link therefore satisfies verification for arbitrary resources. Because the check runs before other authentication layers, downstream controls such as SSO, PINs, resource passwords, email allowlists, and header authentication are never evaluated. The failure crosses organizational boundaries, allowing lateral access across tenants on shared infrastructure.
Root Cause
The root cause is an authorization bypass through a user-controlled key [CWE-639]. The token verification function trusts a client-supplied identifier and does not correlate it with the resource path being served. This decoupling breaks the intended binding between token, resource, and organization.
Attack Vector
Exploitation occurs over the network with low attacker privileges and no user interaction. An attacker obtains one legitimate share link from any resource in any organization. The attacker then issues a request to the share-link authentication endpoint targeting a different resource while presenting the original token. Successful authentication yields access to the targeted resource. Technical details are described in the VulnCheck Authentication Bypass Advisory.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-72001
Indicators of Compromise
- Requests to the share-link authentication endpoint where the URL parameter references a resource different from the one associated with the presented token.
- Successful authentications from a single share token against multiple resource identifiers or organization scopes within a short window.
- Access to protected resources without corresponding SSO, PIN, or password challenge events in application logs.
Detection Strategies
- Correlate share-link token identifiers with the resource identifiers they authenticate against and alert on one-to-many relationships.
- Baseline normal share-link usage per token and flag deviations that touch resources outside the original organization.
- Inspect reverse-proxy and application logs for share-link requests that skip downstream authentication middleware.
Monitoring Recommendations
- Enable verbose logging on the Pangolin authentication endpoints and forward events to a centralized log platform.
- Monitor for outbound access to protected resources following share-link authentication events that lack expected auth artifacts.
- Track version and build identifiers of running Pangolin instances to confirm patch status across deployments.
How to Mitigate CVE-2026-72001
Immediate Actions Required
- Upgrade all Pangolin instances to version 1.22.0 or later without delay.
- Rotate or revoke existing share links after upgrade to invalidate tokens that may have been abused.
- Audit access logs since deployment for anomalous share-link authentications across organizations.
Patch Information
The vulnerability is fixed in Pangolin 1.22.0. Release notes and the corrected token verification logic are available in the GitHub Pangolin Release 1.22.0 advisory. Administrators should validate the upgrade in staging and then roll out to production with configuration and share-link inventories reviewed.
Workarounds
- Disable the share-link authentication feature until the upgrade is applied if the deployment can tolerate the functional loss.
- Restrict network exposure of the Pangolin management and authentication endpoints to trusted networks or VPN clients.
- Revoke all outstanding share links and require reissuance after patching to eliminate legacy tokens.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
