CVE-2026-82410

PocketBase, an open-source Go web backend, applies its panic-recovery middleware only to regular request handling, leaving internal child and worker goroutines unprotected against uncaught panics (CWE-248). If a panic occurs inside one of these internal goroutines — such as background or realtime worker code — it escapes recovery and terminates the entire server process. Per the CVSS vector (network vector, low complexity, no privileges or user interaction required), an unauthenticated remote attacker who can reach the server can induce such a crash, gaining a denial of service with no confidentiality or integrity impact. All deployments running versions prior to 0.22.48 on the 0.22 maintenance line, or prior to 0.39.7 on the current line, are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known at this time.

What to do: Upgrade to PocketBase 0.39.7, or 0.22.48 if you are pinned to the 0.22 maintenance branch; the fix adds routine.SafeWrap so worker-goroutine panics become handled errors instead of process crashes. If you cannot patch immediately, restrict unauthenticated network access to the instance (reverse-proxy authentication, firewall rules) and run the binary under a supervisor (e.g., systemd) that restarts it after a crash. Verify the running version in the admin dashboard after upgrading.