Skip to content
Fencer Vulns
high 7.5

CVE-2020-26160 json

Authorization bypass in github.com/dgrijalva/jwt-go

published 2020-09-30 6 y ago modified 2026-09-10 1 mo ago also GHSA-w73w-5m7g-f7qc , GO-2020-0017 , EUVD-2021-1212

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

Patch / fix

  • go github.com/dgrijalva/jwt-go/v4 4.0.0-preview1
  • golang-github-dgrijalva-jwt-go Debian 12 3.2.0-3

debian advisories DEBIAN-CVE-2020-26160

  • mcg openshift container storage 4.7 5.7.0-69.85e2026.5.7.el8

red hat advisories RHSA-2021:2042

  • telegraf openSUSE Tumbleweed 1.19.0-1.2
  • velero-plugin-for-microsoft-azure openSUSE Tumbleweed 1.3.1-1.1

opensuse advisories openSUSE-SU-2024:11428-1openSUSE-SU-2024:11668-1

  • gitea Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.14.6-r0

alpine advisories ALPINE-CVE-2020-26160

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dcos-cli Azure Linux 3.0 1.2.0-15

azure linux advisories AZL-41684

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-26160 updated cvss 7.5

jwt-go: access restriction bypass vulnerability

  • Red Hat OpenShift Service Mesh 1 kiali, servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-galley, servicemesh-citadel, +6 more Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +10 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-cli, openshift4/ose-deployer, openshift4/ose-installer, openshift4/ose-descheduler, openshift4/ose-tools-rhel9, openshift4/ose-ptp-operator, +25 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 1 virt-cdi-cloner, virt-cdi-importer, virt-cdi-operator, virt-cdi-apiserver, virt-cdi-controller, virt-cdi-uploadproxy, +1 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Virtualization 2 kubemacpool, node-maintenance-operator, kubernetes-nmstate-handler, hyperconverged-cluster-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Quay 3 quay-setup-operator, quay-bridge-operator Red Hat Storage 3 etcd, heketi, heketi-client, python-heketi, multi-cloud-object-gateway-cli
    affected: no fix planned “Will not fix”
  • Red Hat Cryostat 2 on RHEL 8 cryostat-20-tech-preview/cryostat-rhel8-operator 2.0.0-5, cryostat-20-tech-preview/cryostat-operator-bundle 2.0.0-6.1639085863
    fixed: vendor fix RHSA-2021:5110
  • Red Hat Openshift Serverless 1.13 openshift-serverless-1/client-kn-rhel8 0.19.1-4, openshift-serverless-1/serving-queue-rhel8 0.19.0-6, openshift-serverless-1/eventing-mtping-rhel8 0.19.2-3, openshift-serverless-1/kourier-control-rhel8 0.19.0-3, openshift-serverless-1/serving-webhook-rhel8 0.19.0-5, openshift-serverless-1/eventing-webhook-rhel8 0.19.2-3, +22 more
    fixed: vendor fix RHSA-2021:0516
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-azure-machine-controllers v4.7.0-202102130115.p0
    fixed: vendor fix RHSA-2020:5633
show 3 more
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-etcd v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream, openshift4/ose-baremetal-installer-rhel8 v4.8.0-202106291913.p0.git.a5ddd2d.assembly.stream
    fixed: vendor fix RHSA-2021:2438
  • Red Hat OpenShift Container Storage 4.7 on RHEL-8 mcg 5.7.0-69.85e2026.5.7.el8, ocs4/mcg-rhel8-operator 5.7.0-69.85e2026.5.7
    fixed: vendor fix RHSA-2021:2042
  • Red Hat Distributed Tracing Jaeger 1 distributed-tracing/jaeger-rhel7-operator Red Hat Advanced Cluster Management for Kubernetes 2 jwt-go Red Hat OpenShift Container Platform 3.11 openshift3/prometheus Red Hat OpenShift Container Platform 4 openshift4/ose-tests, openshift4/ose-telemeter, openshift4/ose-kube-proxy, openshift4/ose-thanos-rhel9, openshift4/ose-baremetal-rhel8-operator, openshift4/ose-cloud-credential-operator Red Hat OpenShift Container Platform 4.7 openshift4/ose-cli v4.7.0-202102130115.p0, openshift4/ose-pod v4.7.0-202102130115.p0, openshift4/ose-etcd v4.7.0-202102130115.p0, openshift4/ose-tests v4.7.0-202102181036.p0, openshift4/ose-console v4.7.0-202102130115.p0, openshift4/ose-coredns v4.7.0-202102130115.p0, +129 more Red Hat OpenShift Container Platform 4.8 openshift4/ose-cli v4.8.0-202106291725.p0.git.1077b05.assembly.stream, openshift4/ose-pod v4.8.0-202107161820.p0.git.051ac4f.assembly.stream, openshift4/ose-tests v4.8.0-202107131424.p0.git.0d958c3.assembly.stream, openshift4/ose-console v4.8.0-202107010336.p0.git.188a490.assembly.stream, openshift4/ose-coredns v4.8.0-202106291913.p0.git.642b46e.assembly.stream, openshift4/ose-grafana v4.8.0-202106291913.p0.git.b987e4b.assembly.stream, +134 more
    +3 more products
    Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/ocs-operator-bundle 4.7.0-11, ocs4/mcg-core-rhel8 5.7.0-60.2c1fdb0.5.7, ocs4/cephcsi-rhel8 4.7-102.5c44836.release_4.7, ocs4/ocs-rhel8-operator 4.7-174.7f14177.release_4.7, ocs4/ocs-must-gather-rhel8 4.7-174.7f14177.release_4.7, ocs4/rook-ceph-rhel8-operator 4.7-140.49a6fcf.release_4.7 Red Hat OpenShift Virtualization 1 ovs-cni-plugin, virt-controller Red Hat OpenShift Virtualization 2 bridge-marker, ovs-cni-marker, ovs-cni-plugin, virt-cdi-cloner, virt-controller, virt-cdi-importer, +10 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.16% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/dgrijalva/jwt-go
>=0.0.0-20150717181359-44718f8a89b0, <=3.2.0
>=0.0.0-20150717181359-44718f8a89b0
 no fix listed
go github.com/dgrijalva/jwt-go/v4
<4.0.0-preview1
4.0.0-preview1

Classification

Weakness
  • CWE-287 Improper Authentication
  • CWE-755 Improper Handling of Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.