CVE-2026-72564: Pangolin Auth Bypass Vulnerability

CVE-2026-72564 Overview

CVE-2026-72564 is an improper authorization vulnerability in fosrl/pangolin through version v1.20.0. An authenticated remote attacker can authenticate to any resource in any organization by reusing an access token issued for a different resource. The flaw resides in the resource authentication logic at server/routers/resource/authWithAccessToken.ts, which fails to bind access tokens to their intended resource scope. The weakness is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated user holding a valid access token for one resource can pivot to authenticate against any other resource across any organization, breaking tenant isolation.

Affected Products

fosrl/pangolin through version v1.20.0
Deployments exposing the authWithAccessToken endpoint
Multi-tenant Pangolin installations serving multiple organizations

Discovery Timeline

2026-08-10 - CVE-2026-72564 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72564

Vulnerability Analysis

Pangolin is an open-source tunneled reverse proxy that issues per-resource access tokens to authenticated users. The authWithAccessToken route validates that a submitted token exists and is valid but does not verify that the token was issued for the resource the caller is attempting to access. As a result, authorization is decoupled from the resource identifier supplied in the request.

An attacker who legitimately possesses a token for a low-value resource can present that same token when requesting authentication to a different resource. The server accepts the token and grants access. Because the check does not scope to organizations either, the pivot extends across tenant boundaries.

The attack requires only low-privileged authenticated access. No user interaction is required, and the scope of impact changes from the attacker's original resource to any other resource in the deployment.

Root Cause

The root cause is a missing authorization check that ties an access token to the specific resource identifier for which it was issued. The logic in authWithAccessToken.ts treats token validity as sufficient proof of authorization, without confirming the resourceId claim on the token matches the resource being requested. This is the pattern described by CWE-639, where authorization decisions rely on a user-controlled key.

Attack Vector

Exploitation is performed over the network against the Pangolin API. An attacker obtains a valid access token for any resource they legitimately control, then submits that token in an authentication request targeting a different resource ID belonging to another organization. See the fosrl/pangolin source at authWithAccessToken.ts for the affected code path.

No exploitation code is required beyond replaying a known-good token against a different resource identifier. See the fosrl/pangolin repository for additional context.

Detection Methods for CVE-2026-72564

Indicators of Compromise

Successful authWithAccessToken requests where the token's original resourceId does not match the requested resource
The same access token appearing in authentication events against multiple distinct resource IDs
Access token authentications spanning multiple organization IDs from a single user or session
Unexpected resource access events immediately following a legitimate authentication to an unrelated resource

Detection Strategies

Correlate access token identifiers against the resource ID recorded at issuance and alert when they diverge at validation time
Baseline the set of resources each user typically authenticates to and flag first-time access across organizational boundaries
Instrument the authWithAccessToken route with audit logging that captures both the token's claimed resource and the requested resource

Monitoring Recommendations

Forward Pangolin application logs to a centralized analytics platform and retain authentication events for post-incident review
Alert on any single access token used against more than one resourceId within a short time window
Review privileged resource access lists for entries that do not correspond to prior explicit authorization grants

How to Mitigate CVE-2026-72564

Immediate Actions Required

Upgrade fosrl/pangolin to a fixed release published after v1.20.0 once available from the maintainers
Revoke and reissue all outstanding resource access tokens to invalidate tokens an attacker may already hold
Audit recent authentication logs for token reuse across resources or organizations and revoke sessions tied to suspicious activity

Patch Information

At the time of publication, monitor the fosrl/pangolin GitHub repository for a release addressing the improper authorization check in server/routers/resource/authWithAccessToken.ts. The fix must validate that the resourceId claim on the presented token matches the resource in the request path and that the resource belongs to the caller's organization.

Workarounds

Restrict network exposure of the Pangolin API to trusted administrators until an upgrade is applied
Reduce access token lifetimes to shrink the window during which a stolen or misused token remains valid
Segment tenants across separate Pangolin deployments where feasible so a cross-organization pivot is not possible

bash

# Example: rotate all Pangolin resource access tokens after upgrade
# 1. Stop the Pangolin service
systemctl stop pangolin

# 2. Purge existing access tokens from the datastore (adjust for your backend)
#    Review the schema in server/db before running destructive statements
#    e.g. DELETE FROM resource_access_tokens;

# 3. Restart with the patched version and require re-issuance
systemctl start pangolin