CVE-2026-3209

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3209", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-25T16:40:11.724Z", "datePublished": "2026-02-25T23:02:10.115Z", "dateUpdated": "2026-03-08T07:06:50.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T07:06:50.150Z"}, "title": "fosrl Pangolin Role verifyApiKeyRoleAccess access control", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "fosrl", "product": "Pangolin", "versions": [{"version": "1.15.4-s.0", "status": "affected"}, {"version": "1.15.4-s.1", "status": "affected"}, {"version": "1.15.4-s.2", "status": "affected"}, {"version": "1.15.4-s.3", "status": "affected"}, {"version": "1.15.4-s.4", "status": "unaffected"}], "modules": ["Role Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-02-25T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-25T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-01T09:47:12.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "h3nrrrych4u (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "h3nrrrych4u (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/?id.347796", "name": "VDB-347796 | fosrl Pangolin Role verifyApiKeyRoleAccess access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347796", "name": "VDB-347796 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.765676", "name": "Submit #765676 | Pangolin <=1.15.4 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/?submit.766215", "name": "Submit #766215 | Pangolin (https://pangolin.net/) Pangolin Project (https://github.com/fosrl/pangolin) <=1.15.4 Improper Access Controls (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/henrrrychau/0457bef6776d0c99688f9cf55cdf55f7", "tags": ["exploit"]}, {"url": "https://github.com/fosrl/pangolin/pull/2511", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/fosrl/pangolin/commit/5e37c4e85fae68e756be5019a28ca903b161fdd5", "tags": ["patch"]}, {"url": "https://github.com/fosrl/pangolin/releases/tag/1.15.4-s.4", "tags": ["patch"]}, {"url": "https://github.com/fosrl/pangolin/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T16:44:13.503973Z", "id": "CVE-2026-3209", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:44:27.165Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3209", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T16:44:13.503973Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:44:20.702Z"}}], "cna": {"tags": ["x_open-source"], "title": "fosrl Pangolin Role verifyApiKeyRoleAccess access control", "credits": [{"lang": "en", "type": "reporter", "value": "h3nrrrych4u (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "h3nrrrych4u (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "fosrl", "modules": ["Role Handler"], "product": "Pangolin", "versions": [{"status": "affected", "version": "1.15.4-s.0"}, {"status": "affected", "version": "1.15.4-s.1"}, {"status": "affected", "version": "1.15.4-s.2"}, {"status": "affected", "version": "1.15.4-s.3"}, {"status": "unaffected", "version": "1.15.4-s.4"}]}], "timeline": [{"lang": "en", "time": "2026-02-25T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-25T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-01T09:47:12.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347796", "name": "VDB-347796 | fosrl Pangolin Role verifyApiKeyRoleAccess access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347796", "name": "VDB-347796 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.765676", "name": "Submit #765676 | Pangolin <=1.15.4 Improper Access Controls", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/?submit.766215", "name": "Submit #766215 | Pangolin (https://pangolin.net/) Pangolin Project (https://github.com/fosrl/pangolin) <=1.15.4 Improper Access Controls (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/henrrrychau/0457bef6776d0c99688f9cf55cdf55f7", "tags": ["exploit"]}, {"url": "https://github.com/fosrl/pangolin/pull/2511", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/fosrl/pangolin/commit/5e37c4e85fae68e756be5019a28ca903b161fdd5", "tags": ["patch"]}, {"url": "https://github.com/fosrl/pangolin/releases/tag/1.15.4-s.4", "tags": ["patch"]}, {"url": "https://github.com/fosrl/pangolin/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T07:06:50.150Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3209", "state": "PUBLISHED", "dateUpdated": "2026-03-08T07:06:50.150Z", "dateReserved": "2026-02-25T16:40:11.724Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-25T23:02:10.115Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Role Handler"], "product": "Pangolin", "vendor": "fosrl", "versions": [{"status": "affected", "version": "1.15.4-s.0"}, {"status": "affected", "version": "1.15.4-s.1"}, {"status": "affected", "version": "1.15.4-s.2"}, {"status": "affected", "version": "1.15.4-s.3"}, {"status": "unaffected", "version": "1.15.4-s.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en fosrl Pangolin hasta 1.15.4-s.3. Esto afecta a la funci\u00f3n verifyRoleAccess/verifyApiKeyRoleAccess del componente Gestor de Roles. La manipulaci\u00f3n conduce a controles de acceso inadecuados. La explotaci\u00f3n remota del ataque es posible. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. Actualizar a la versi\u00f3n 1.15.4-s.4 mitiga este problema. El identificador del parche es 5e37c4e85fae68e756be5019a28ca903b161fdd5. Se aconseja actualizar el componente afectado."}], "id": "CVE-2026-3209", "lastModified": "2026-06-17T10:43:12.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3209", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T16:44:13.503973Z", "version": "2.0.3"}}]}, "published": "2026-02-25T23:16:21.920", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/henrrrychau/0457bef6776d0c99688f9cf55cdf55f7"}, {"source": "cna@vuldb.com", "url": "https://github.com/fosrl/pangolin/"}, {"source": "cna@vuldb.com", "url": "https://github.com/fosrl/pangolin/commit/5e37c4e85fae68e756be5019a28ca903b161fdd5"}, {"source": "cna@vuldb.com", "url": "https://github.com/fosrl/pangolin/pull/2511"}, {"source": "cna@vuldb.com", "url": "https://github.com/fosrl/pangolin/releases/tag/1.15.4-s.4"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.347796"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.347796"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.765676"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.766215"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.15.4-s.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.15.4-s.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.15.4-s.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.15.4-s.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.15.4-s.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Pangolin", "source": "cna", "vendor": "fosrl"}, "product": "pangolin", "vendor": "fosrl"}], "analysis": {"en": {"generated_at": "2026-04-16T16:09:54.145115+00:00", "value": {"mitigation_remediation": ["Apply the official patch by upgrading to pangolin\u202f1.15.4\u2011s.4 (commit\u00a05e37c4e85fae68e756be5019a28ca903b161fdd5).", "Verify that role and API\u2011key validation logic is enforced by inspecting configuration or running integration tests against the verifyRoleAccess endpoint.", "Restrict network exposure of the Pangolin API or implement a firewall rule so that only trusted hosts can reach the role verification endpoints, and monitor logs for abnormal access patterns."], "summary": {"action": "Apply Patch", "impact": "Improper Access Control leading to potential unauthorized privileged action"}, "threat_synthesis": {"affected_systems": "The flaw affects all releases of fosrl\u00a0Pangolin up to and including version 1.15.4\u2011s.3. Systems running any affected build are at risk until the component is upgraded to 1.15.4\u2011s.4, the first release containing the fix identified by commit\u00a05e37c4e85fae68e756be5019a28ca903b161fdd5.", "description_and_impact": "A vulnerability in the Role Handler of fosrl\u00a0Pangolin software allows an attacker to manipulate the verifyRoleAccess and verifyApiKeyRoleAccess endpoints, resulting in improper access controls. By exploiting this flaw, a remote attacker can bypass intended permission checks and gain unauthorized access to privileged resources or actions. The weakness stems from a missing validation of role or API\u2011key permissions, mapping to CWE\u2011266 and CWE\u2011284.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate risk, while the EPSS value below\u00a01% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but remote exploitation is possible through the exposed API. Attackers would need network access to the Pangolin instance and the ability to craft requests to the role verification endpoints, after which they could elevate privileges or access restricted data."}}}}, "created": "2026-02-26T13:10:42.129253+00:00", "updated": "2026-04-16T16:15:08.473248+00:00", "vendors": ["fosrl", "fosrl$PRODUCT$pangolin"]}