jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in…
Priority LOW 37CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 5 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
Why it matters now
EPSS 0.02158 82nd percentileScored 2026-11-07
Fix Partial github.com/dgrijalva/jwt-go/v4 (Go): 4.0.0-preview1Red Hat: 6 advisoriesRed Hat: 5 fixed, 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/dgrijalva/jwt-go (Go) | 0.0.0-20150717181359-44718f8a89b0 – 3.2.0 | — | No fix listed | GHSA-w73w-5m7g-f7qc |
| — | github.com/dgrijalva/jwt-go/v4 (Go) | before 4.0.0-preview1 | 4.0.0-preview1 | Patch available | GHSA-w73w-5m7g-f7qc |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/dgrijalva/jwt-go (Go) Vendor— Affected 0.0.0-20150717181359-44718f8a89b0 – 3.2.0 Fixed in — No fix listed GHSA-w73w-5m7g-f7qc
- github.com/dgrijalva/jwt-go/v4 (Go) Vendor— Affected before 4.0.0-preview1 Fixed in 4.0.0-preview1 Patch available GHSA-w73w-5m7g-f7qc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jwt-go_project:jwt-go:*:*:*:*:*:*:*:* | up to 3.2.0 | Vulnerable | Jwt-go Project |
- cpe:2.3:a:jwt-go_project:jwt-go:*:*:*:*:*:*:*:* Versions up to 3.2.0 Vulnerable ·Jwt-go Project
Remediation
- Fix · GHSA-w73w-5m7g-f7qc github.com/dgrijalva/jwt-go/v4 (Go) Fixed in 4.0.0-preview1 Advisory →
Red Hat 6 advisories
- RHSA-2021:5110 Released 2021-12-14 · Red Hat rating ModerateCryostat security update
- Cryostat 2 on RHEL 8 cryostat-20-tech-preview/cryostat-operator-bundle, cryostat-20-tech-preview/cryostat-rhel8-operator
- RHSA-2021:2438 Released 2021-07-27 · Red Hat rating ModerateOpenShift Container Platform 4.8.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2021:2042 Released 2021-05-19 · Red Hat rating ModerateRed Hat OpenShift Container Storage 4.7 RPM security, bug fix, and enhancement update
- Red Hat OpenShift Container Storage 4.7 on RHEL-8 mcg-5.7.0-69.85e2026.5.7.el8
Show 3 more Red Hat advisories
- RHSA-2021:2041 Released 2021-05-19 · Red Hat rating ModerateRed Hat OpenShift Container Storage 4.7.0 security, bug fix, and enhancement update
- Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/mcg-core-rhel8, ocs4/mcg-rhel8-operator, ocs4/rook-ceph-rhel8-operator
- RHSA-2021:0799 Released 2021-03-10 · Red Hat rating ModerateOpenShift Virtualization 2.6.0 security and bug fix update
- CNV 2.6 for RHEL 8 container-native-virtualization/kubevirt-cpu-model-nfd-plugin, container-native-virtualization/kubevirt-cpu-node-labeller, container-native-virtualization/kubevirt-kvm-info-nfd-plugin +2
- RHSA-2021:0516 Released 2021-02-18 · Red Hat rating ModerateRelease of OpenShift Serverless 1.13.0 security update
- Openshift Serverless 1.13 openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8, openshift-serverless-1/eventing-controller-rhel8 +25
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2021:5110 |
| Openshift Serverless 1.13 | Fixed | RHSA-2021:0516 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | RHSA-2020:5633 |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2438 |
| Red Hat OpenShift Container Storage 4.7 on RHEL-8 | Fixed | RHSA-2021:2041, RHSA-2021:2042 |
Not affected: 9 products
- Distributed Tracing Jaeger 1
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.7
- Red Hat OpenShift Container Platform 4.8
- Red Hat OpenShift Container Storage 4.7 on RHEL-8
- Red Hat OpenShift Virtualization 1
- Red Hat OpenShift Virtualization 2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26160
- 2026-10-03 Alias added: GHSA-w73w-5m7g-f7qc
References
Sources
- CVE-2020-26160 · CVE Program
- CVE-2020-26160 · NVD
- FIRST EPSS
- GHSA-w73w-5m7g-f7qc · GitHub Advisory Database · CC BY 4.0
- CVE-2020-26160 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences