--- id: CVE-2020-26160 title: 'jwt-go: access restriction bypass vulnerability (CVE-2020-26160)' summary: >- A vulnerability was found in jwt-go where it is vulnerable to Access Restriction Bypass if m["aud"] happens to be []string{}, as allowed by the spec, the type assertion fails and the value of aud is "". This can cause audience verification… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cvssSource: vendor cwe: CWE-284 vendor: Red Hat product: Red Hat OpenShift Container Platform 4 affected: - openshift_service_mesh 1 - openshift_container_platform 3.11 - openshift_container_platform 4 - openshift_virtualization 1 - openshift_virtualization 2 - quay 3 - storage 3 - cryostat_2_on_rhel 8 - openshift_serverless 1.13 - openshift_container_storage_4_7_on_rhel_8 - openshift_container_platform 4.7 - openshift_container_platform 4.8 patched: - cryostat_2_on_rhel 8 - openshift_serverless 1.13 - openshift_container_storage_4_7_on_rhel_8 - openshift_container_platform 4.7 - openshift_container_platform 4.8 published: '2020-09-15' updated: '2026-10-16' sourceUpdated: '2026-10-16T17:14:19+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-26160.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-26160.json - url: 'https://access.redhat.com/security/cve/CVE-2020-26160' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1883371' - url: 'https://www.cve.org/CVERecord?id=CVE-2020-26160' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-26160' - url: 'https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515' - url: 'https://access.redhat.com/errata/RHSA-2021:5110' - url: 'https://access.redhat.com/errata/RHSA-2021:0516' - url: 'https://access.redhat.com/errata/RHSA-2021:2042' - url: 'https://access.redhat.com/errata/RHSA-2021:2041' - url: 'https://access.redhat.com/errata/RHSA-2020:5633' - url: 'https://access.redhat.com/errata/RHSA-2021:2438' - url: 'https://github.com/dgrijalva/jwt-go/issues/422' - url: 'https://github.com/dgrijalva/jwt-go/issues/462' - url: 'https://github.com/dgrijalva/jwt-go/pull/426' - url: >- https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab - url: 'https://github.com/dgrijalva/jwt-go' - url: 'https://pkg.go.dev/vuln/GO-2020-0017' tags: - csaf - vex - red-hat - exploit-available - osv - go epss: 0.02158 epssPercentile: 0.82097 exploits: github: 1 githubRepos: - 'https://github.com/mlbrilliance/aurora-demo-lockfile' checkedAt: '2026-10-27T16:39:15.561Z' exploitAvailable: true aliases: - GHSA-w73w-5m7g-f7qc - GO-2020-0017 - SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515 ecosystem: go ingestedAt: '2026-07-09T18:56:36.957Z' --- ## Overview A vulnerability was found in jwt-go where it is vulnerable to Access Restriction Bypass if m["aud"] happens to be []string{}, as allowed by the spec, the type assertion fails and the value of aud is "". This can cause audience verification to succeed even if the audiences being passed are incorrect if required is set to false. ## Vendor advisories - **RHSA-2021:5110** · Red Hat · fixed in: Cryostat 2 on RHEL 8 · released 2021-12-14 · [advisory](https://access.redhat.com/errata/RHSA-2021:5110) - **RHSA-2021:0516** · Red Hat · fixed in: Openshift Serverless 1.13 · released 2021-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2021:0516) - **RHSA-2021:2042** · Red Hat · fixed in: Red Hat OpenShift Container Storage 4.7 on RHEL-8 · released 2021-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2021:2042) - **RHSA-2021:2041** · Red Hat · fixed in: Red Hat OpenShift Container Storage 4.7 on RHEL-8 · released 2021-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2021:2041) - **RHSA-2020:5633** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.7 · released 2021-02-24 · [advisory](https://access.redhat.com/errata/RHSA-2020:5633) - **RHSA-2021:2438** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.8 · released 2021-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2021:2438) - **Red Hat VEX** · Moderate · affected: OpenShift Service Mesh 1, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Virtualization 1, Red Hat OpenShift Virtualization 2, Red Hat Quay 3, … · no fix planned: Red Hat OpenShift Virtualization 1, OpenShift Service Mesh 1, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-26160.json) **jwt-go: access restriction bypass vulnerability** — rated Moderate by Red Hat. Released 2020-09-15, updated 2026-10-16. Affected: - OpenShift Service Mesh 1 - Red Hat OpenShift Container Platform 3.11 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Virtualization 1 - Red Hat OpenShift Virtualization 2 - Red Hat Quay 3 - Red Hat Storage 3 Fixed: - Cryostat 2 on RHEL 8 - Openshift Serverless 1.13 - Red Hat OpenShift Container Storage 4.7 on RHEL-8 - Red Hat OpenShift Container Platform 4.7 - Red Hat OpenShift Container Platform 4.8 No fix planned: - Red Hat OpenShift Virtualization 1 - OpenShift Service Mesh 1 - Red Hat OpenShift Container Platform 3.11 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Virtualization 2 - Red Hat Quay 3 - Red Hat Storage 3 Not affected: - Red Hat OpenShift Container Storage 4.7 on RHEL-8 - Red Hat OpenShift Container Platform 4.7 - Red Hat OpenShift Container Platform 4.8 - Distributed Tracing Jaeger 1 - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat OpenShift Container Platform 3.11 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Virtualization 1 - Red Hat OpenShift Virtualization 2 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2021:5110 See the documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/index https://access.redhat.com/errata/RHSA-2021:0516 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2021:2042 ## Package advisory (CVE-2020-26160) Affected packages: - `github.com/dgrijalva/jwt-go >= 0.0.0-20150717181359-44718f8a89b0, <= 3.2.0` - `github.com/dgrijalva/jwt-go/v4 < 4.0.0-preview1` Patched in: - `github.com/dgrijalva/jwt-go/v4 4.0.0-preview1` Source: https://osv.dev/vulnerability/GHSA-w73w-5m7g-f7qc