CVE-2026-72001

Pangolin before 1.22.0, a self-hosted tunneled reverse proxy and identity-aware access platform, contains an authentication bypass (CWE-639) in its share-link authentication endpoint. When verifying a share-link token, the endpoint accepts an attacker-controlled URL parameter and omits the expected resource identifier from the token verification call, so a single valid share link for any resource can be used to authenticate to arbitrary protected resources, including resources belonging to other organizations. This bypasses all configured access controls on the targeted resource, including SSO, resource passwords, PIN codes, email allowlists, and header authentication. Any deployment running a Pangolin version prior to 1.22.0 that issues or accepts share links is affected, and exploitation requires network access plus possession of at least one valid share link (CVSS 4.0: 8.6 High). There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%, so no exploitation is currently confirmed.

What to do: Upgrade to Pangolin 1.22.0 or later, which fixes the share-link token verification. Until patched, restrict network exposure of the Pangolin authentication/share-link endpoint, limit issuance of share links where possible, and review access logs for share-link authentications that reached resources outside the link's original organization. Because any single valid share link grants access across organizations, consider rotating broadly distributed share links after patching.