CVE-2026-82410: PocketBase Denial of Service Vulnerability

CVE-2026-82410 Overview

CVE-2026-82410 affects PocketBase, an open source web backend written in Go. The vulnerability exists in versions prior to 0.22.48 and 0.39.7. PocketBase's panic-recovery middleware protects regular request handling but does not cover internal child and worker goroutines. A panic inside one of these internal goroutines escapes recovery and terminates the server process, resulting in denial of service. The maintainers introduced routine.SafeWrap to convert recovered panics into regular errors and applied it to the affected internal worker functions. The issue is fixed in versions 0.22.48 and 0.39.7.

Critical Impact
An unauthenticated remote attacker can trigger an unrecovered goroutine panic to crash the PocketBase server process, causing service outage.

Affected Products

PocketBase versions prior to 0.22.48
PocketBase versions in the 0.39.x branch prior to 0.39.7
Applications embedding vulnerable PocketBase releases as a Go dependency

Discovery Timeline

2026-09-16 - CVE-2026-82410 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82410

Vulnerability Analysis

PocketBase wraps HTTP request handlers with panic-recovery middleware that catches runtime panics and returns errors instead of terminating the process. This safety net only applies to the request-handling call stack. Internal features such as background workers, scheduled jobs, and streaming pipelines execute inside child goroutines spawned with bare go func() calls. A panic raised inside those goroutines propagates to the Go runtime and terminates the entire process.

The weakness is classified as [CWE-248] Uncaught Exception. An unauthenticated attacker with network reach to the PocketBase HTTP interface can send input that triggers a panic path inside one of the unwrapped worker goroutines, terminating the server for all users.

Root Cause

The root cause is inconsistent panic handling across concurrency boundaries. Go does not propagate recover() across goroutines, so recovery installed on the request goroutine cannot catch panics raised in a child goroutine. Multiple internal call sites, including backup handling in apis/backup.go, batch processing in apis/batch.go, realtime streams in apis/realtime.go, and periodic tasks in core/base.go, launched goroutines without their own deferred recover.

Attack Vector

Exploitation requires network access to the PocketBase API. No authentication or user interaction is needed. The attacker submits a request that reaches a code path executed inside an unprotected internal goroutine and provokes a panic, for example through a malformed payload or a resource condition that raises a runtime error. The unrecovered panic terminates the process and denies service to all clients.

// Patch: core/base.go — wrap the background loop with routine.FireAndForget,
// which installs a deferred recover so panics become errors instead of
// crashing the process.
-	go func() {
+	routine.FireAndForget(func() {
 		ctx := context.Background()
 
 		for {
// Source: https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220

// Patch: apis/backup.go — import the routine helper used to wrap internal
// goroutines with panic recovery.
 	"github.com/pocketbase/pocketbase/tools/rest"
+	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/types"
// Source: https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220

// Patch: apis/batch.go — same routine helper added to guard batch worker
// goroutines against unrecovered panics.
 	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/routine"
 	"github.com/pocketbase/pocketbase/tools/types"
// Source: https://github.com/pocketbase/pocketbase/commit/f1618ee59b6d1c0308bb474c827a2b1f24b12a95

Detection Methods for CVE-2026-82410

Indicators of Compromise

Unexpected termination of the PocketBase process with a Go runtime panic stack trace in stdout or stderr logs.
Log lines referencing runtime error or panic: originating outside the HTTP request handler frames.
Repeated automated restarts of the PocketBase service by systemd, Docker, or Kubernetes shortly after specific inbound requests.

Detection Strategies

Compare the running PocketBase binary version against the fixed releases 0.22.48 and 0.39.7 using the pocketbase --version command.
Correlate HTTP access logs with process crash timestamps to identify request patterns that precede termination.
Alert on abnormal crash-loop frequency for the PocketBase container or service in orchestration platforms.

Monitoring Recommendations

Forward PocketBase stdout/stderr and process supervisor events to a centralized logging pipeline for panic string matching.
Track availability with external synthetic checks against the PocketBase API and alert on repeated connection failures.
Monitor request rates against realtime, batch, and backup endpoints for anomalous spikes from single sources.

How to Mitigate CVE-2026-82410

Immediate Actions Required

Upgrade PocketBase to 0.22.48 if running the 0.22.x branch, or to 0.39.7 if running the 0.39.x branch.
Restart the PocketBase process after upgrading and verify the reported version.
Restrict network exposure of the PocketBase API to trusted networks or place it behind an authenticated reverse proxy until patched.

Patch Information

The fix is delivered in PocketBase v0.22.48 and PocketBase v0.39.7. The maintainers introduced a routine.SafeWrap helper that installs a deferred recover() around internal goroutines and converts recovered panics into regular errors. The changes are documented in the GitHub Security Advisory GHSA-84vh-m24q-wjjx and in the patch commits 30b4184 and f1618ee.

Workarounds

Run PocketBase under a process supervisor such as systemd, Docker with --restart, or Kubernetes to auto-restart the process after crashes.
Place a reverse proxy in front of PocketBase and enforce authentication, rate limiting, and payload validation on public endpoints.
Temporarily disable optional features such as backups, batch APIs, or realtime subscriptions if they are not required.

bash

# Upgrade PocketBase to a patched release
# 0.22.x branch
wget https://github.com/pocketbase/pocketbase/releases/download/v0.22.48/pocketbase_0.22.48_linux_amd64.zip
unzip -o pocketbase_0.22.48_linux_amd64.zip -d /opt/pocketbase
/opt/pocketbase/pocketbase --version
systemctl restart pocketbase

# 0.39.x branch
wget https://github.com/pocketbase/pocketbase/releases/download/v0.39.7/pocketbase_0.39.7_linux_amd64.zip
unzip -o pocketbase_0.39.7_linux_amd64.zip -d /opt/pocketbase
/opt/pocketbase/pocketbase --version
systemctl restart pocketbase