CVE-2020-26160 is a high-severity (CVSS 7.5) Improper Authentication vulnerability in github.com/dgrijalva/jwt-go. A fix is available for github.com/dgrijalva/jwt-go — see the affected versions and patch details below.
Authorization bypass in github.com/dgrijalva/jwt-go
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2020-26160 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
github.com/dgrijalva/jwt-go🐹github.com/dgrijalva/jwt-go/v4Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to golang-jwt at version 3.2.1
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/dgrijalva/jwt-go | ≥ 0.0.0-20150717181359-44718f8a89b0 | No fix |
| 🐹Go | github.com/dgrijalva/jwt-go/v4 | all versions | 4.0.0-preview1go get github.com/dgrijalva/jwt-go/v4@v4.0.0-preview1 |
Affected Products
jwt-gojwt-go_projectDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/dgrijalva/jwt-go, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
No patched version of github.com/dgrijalva/jwt-go has shipped for CVE-2020-26160 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
The github.com/dgrijalva/jwt-go module is an indirect dependency of the k8s.io/client-go module pulled into Quay Bridge, and Setup operators via the Operator's SDK generated code. The k8s.io/client-go module does not use jwt-go in an unsafe way [1]. Red Hat Quay components have been marked as wontfix. This may be…
| Product | Fixed in | Advisory |
|---|---|---|
| Cryostat 2 on RHEL 8 | cryostat-20-tech-preview/cryostat-operator-bundle:2.0.0-6.1639085863 | RHSA-2021:5110 |
| Openshift Serveless 1.13 | openshift-serverless-1/client-kn-rhel8:0.19.1-4 | RHSA-2021:0516 |
| Red Hat OpenShift Container Platform 4.7 | openshift4/ose-azure-machine-controllers:v4.7.0-202102130115.p0 | RHSA-2020:5633 |
| Red Hat OpenShift Container Platform 4.8 | openshift4/ose-baremetal-installer-rhel8:v4.8.0-202106291913.p0.git.a5ddd2d.assembly.stream | RHSA-2021:2438 |
| Red Hat OpenShift Container Storage 4.7.0 on RHEL-8 | ocs4/mcg-rhel8-operator:5.7.0-69.85e2026.5.7 | RHSA-2021:2041 |
| Red Hat OpenShift Container Storage 4.7.0 on RHEL-8 | mcg-0:5.7.0-69.85e2026.5.7.el8 | RHSA-2021:2042 |
Frequently Asked Questions
Is CVE-2020-26160 in your dependencies?
Find it across Go, including transitive dependencies.