NIXPKGS-2026-0350

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-3209

6.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
2 packages
- pangolin
- pangolin-cli
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

fosrl Pangolin Role verifyApiKeyRoleAccess access control

A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised.

References

VDB-347796 | fosrl Pangolin Role verifyApiKeyRoleAccess access control technical-descriptionvdb-entry
VDB-347796 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
Submit #765676 | Pangolin <=1.15.4 Improper Access Controls third-party-advisory
https://gist.github.com/henrrrychau/0457bef6776d0c99688f9cf55cdf55f7 exploit
https://github.com/fosrl/pangolin/pull/2511 patchissue-tracking
https://github.com/fosrl/pangolin/commit/5e37c4e85fae68e756be5019a28ca903b161fd… patch
https://github.com/fosrl/pangolin/releases/tag/1.15.4-s.4 patch
https://github.com/fosrl/pangolin/ product

Affected products

Pangolin

==1.15.4-s.1
==1.15.4-s.3
==1.15.4-s.0
==1.15.4-s.2
==1.15.4-s.4

Matching in nixpkgs

pkgs.fosrl-pangolin

Tunneled reverse proxy server with identity and access control

nixos-unstable 1.15.3
- nixpkgs-unstable 1.15.3
- nixos-unstable-small 1.15.3

Ignored packages (2)

pkgs.pangolin

None

pkgs.pangolin-cli

Pangolin CLI tool and VPN client

nixos-unstable 0.3.3
- nixpkgs-unstable 0.3.3
- nixos-unstable-small 0.3.3

Package maintainers

@jackrosenberg Jack Rosenberg <nixos@jackr.eu>
@water-sucks Varun Narravula <varun@snare.dev>

Upstream patch: https://github.com/fosrl/pangolin/commit/5e37c4e85fae68e756be5019a28ca903b161fdd5

Nixpkgs security tracker