Loading vulnerability…
Pangolin versions before 1.22.0 contain an authentication bypass in the share-link authentication endpoint. An attacker can supply an attacker-controlled URL parameter that causes share-link token verification to occur without validating the expected resource identifier. Consequently, a valid share link issued for one resource can be used to authenticate to arbitrary protected resources, including resources in other organizations.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This eight-file repository is a functional Python proof of concept for CVE-2026-72001 in fosrl/pangolin versions before 1.22.0. The main entry point, exploit.py, uses only Python standard-library HTTP facilities and accepts a target API URL, a legitimate share-link accessToken/accessTokenId pair, and an arbitrary victim resourceId. It sends a request to the unauthenticated access-token route with Pangolin's static CSRF header value. On vulnerable builds, the server validates the token but fails to pass the requested resource ID into the token-binding check; it subsequently creates a request session for the attacker-chosen resource rather than the token's original resource. The PoC reports the minted request token and redirect URL. Its optional proof mode contacts the internal Badger API to exchange that request token into a target-domain session cookie and validates it through Badger's verify-session enforcement route. The repository also contains a Bash lab harness, lab/setup.sh, which starts Pangolin in Docker using host networking and SQLite, provisions two separate organizations and resources, password-protects the victim resource, creates a share link only for the attacker-controlled resource, and invokes exploit.py. Evidence files record successful cross-organization access against 1.21.1 and the expected HTTP 401 resource-ID mismatch response against fixed 1.22.0. README.md and ANALYSIS.md document the vulnerable code path, root cause, impact, remediation, and detection guidance. This is a genuine operational exploit rather than a detection-only script; it requires a preexisting valid share token but bypasses configured authentication controls for other resources on the same vulnerable Pangolin instance.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authentication-bypass vulnerability in Pangolin versions before 1.22.0. An attacker possessing one valid share link can manipulate a URL parameter at the share-link authentication endpoint to authenticate to arbitrary protected resources, including resources in other organizations, bypassing SSO, passwords, PINs, email allowlists, and header authentication.
An unauthenticated, network-accessible authentication-bypass flaw in Pangolin versions before 1.22.0. An attacker with one valid share link can manipulate the share-link endpoint to authenticate to arbitrary protected resources across organizations, bypassing SSO, passwords, PINs, email allowlists, and header authentication.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.