CVE-2026-72564 fosrl CVE debrief

Who should care

Security teams and administrators responsible for fosrl/pangolin deployments should prioritize this CVE. The vulnerability's critical severity and potential for unauthorized access make it a high-risk issue that requires immediate attention and remediation. Affected operators and platforms should review and update their deployments to prevent exploitation. Vulnerability management and security teams should track exceptions and retest remediated assets to ensure the issue is resolved.

Technical summary

CVE-2026-72564 is a critical improper authorization vulnerability in fosrl/pangolin through v1.20.0. An authenticated remote attacker can exploit this vulnerability by reusing an access token issued for a different resource to authenticate to any resource in any organization. The vulnerability has a CVSS score of 9.6 and is classified as CRITICAL. This issue emphasizes the need for immediate attention and remediation. Affected product deployments should be reviewed and updated to a version beyond v1.20.0 if available. Additional authentication and authorization checks for resource access should be implemented. Monitoring for and restricting reuse of access tokens across different resources is crucial. Conduct thorough inventory checks for affected systems and apply vendor remediation. Consider compensating controls and enhanced monitoring for potential exploitation attempts.

Defensive priority

Authenticated remote attackers may exploit this critical vulnerability to access unauthorized resources, emphasizing the need for immediate attention and remediation.

Recommended defensive actions

• Review and update fosrl/pangolin to a version beyond v1.20.0 if available
• Implement additional authentication and authorization checks for resource access
• Monitor for and restrict reuse of access tokens across different resources
• Conduct thorough inventory checks for affected systems and apply vendor remediation
• Consider compensating controls and enhanced monitoring for potential exploitation attempts

Evidence notes

The CVE-2026-72564 record indicates a critical improper authorization vulnerability in fosrl/pangolin through v1.20.0. An authenticated remote attacker can reuse an access token issued for a different resource to authenticate to any resource in any organization. The CVSS score is 9.6, and the severity is CRITICAL. Evidence is limited to CVE and NVD details. Defenders should verify affected deployments, review vendor guidance, and monitor for potential exploitation attempts.

Official resources