Read the docs
TI-2024-31896 Aliases CVE-2024-47616GHSA-r7rh-jww5-5fjr

Pomerium's service account access token may grant unintended access to databroker API

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization. Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings. A Pomerium deployment is susceptible to this issue if all of the following conditions are met, you have issued a service account access token using Pomerium Zero or Pomerium Enterprise, the access token has an explicit expiration date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. This vulnerability is fixed in 0.27.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00577 47th percentileScored 2026-11-07
Fix Fixed pomerium (pomerium): 0.27.1github.com/pomerium/pomerium (Go): 0.27.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pomeriumpomeriumbefore 0.27.10.27.1Patch availableCNA
—github.com/pomerium/pomerium (Go)before 0.27.10.27.1Patch availableGHSA-r7rh-jww5-5fjr
  • pomerium Vendorpomerium Affected before 0.27.1 Fixed in 0.27.1 Patch available CNA
  • github.com/pomerium/pomerium (Go) Vendor— Affected before 0.27.1 Fixed in 0.27.1 Patch available GHSA-r7rh-jww5-5fjr

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:*——pomerium
  • cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:* Versions — — ·pomerium

Remediation

  • Fix · CNA pomerium (pomerium) Fixed in 0.27.1
  • Fix · GHSA-r7rh-jww5-5fjr github.com/pomerium/pomerium (Go) Fixed in 0.27.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47616
  2. 2026-10-03 Alias added: GHSA-r7rh-jww5-5fjr

References

Advisory 1

Other 5

  • TI-2026-37028 Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback CVSS 3.1HIGH 7.5
  • TI-2023-16366 Incorrect Authorization with specially crafted requests CVSS 3.1CRITICAL 10.0
  • TI-2022-08610 Exposure of Sensitive Information in Pomerium CVSS 3.1CRITICAL 9.1
  • TI-2021-16548 Incorrect handling of H2 GOAWAY + SETTINGS frames CVSS 3.1HIGH 8.6
  • TI-2021-18069 OIDC claims not updated from Identity Provider in Pomerium CVSS 3.1HIGH 8.8
  • TI-2021-16591 Incorrect Authorization with specially crafted requests CVSS 3.1HIGH 8.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences