CVE-2026-72001: Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against arbitrary resources across different organizations, bypassing all configured authentication methods including SSO, resource passwords, PIN codes, email allowlists, and header authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pangolinto a version that resolves this vulnerability.Fixed in 1.22.0 - Compensating control
Until upgraded, prevent external access to the Pangolin share-link authentication endpoint (e.g., block the endpoint at a network/WAF/ingress layer) so attackers cannot exploit the share-link authentication bypass.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Pangolin deployments running versions before 1.22.0 are affected. Exposure is not limited to a particular authentication setup: SSO, resource passwords, PIN codes, email allowlists, and header authentication can all be bypassed.
What does an attacker need to exploit it?
An attacker needs one valid share link for any resource. They can then use an attacker-controlled URL parameter at the share-link authentication endpoint to authenticate to arbitrary protected resources, including resources in different organizations.
Are resources protected by stronger or additional authentication controls safe?
No. The bypass applies despite configured authentication methods, including SSO and resource-level controls such as passwords, PIN codes, email allowlists, and header authentication.
What version resolves the issue?
Upgrade Pangolin to version 1.22.0 or later. The vulnerability affects versions before 1.22.0.