CVE-2026-38601
Hardcoded session secret in GoHTTPServer enables user impersonation
A public proof of concept exists; no exploitation attested.
- Published2026-11-03
- WeaknessCWE-798
Am I affected?
Debian, Ubuntu or Red Hat sometimes backport a fix without changing the upstream version number: such a version reads « to verify », never « affected ».With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.
Description
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.
Timeline
dates in UTC- 2026-11-03CVE publishedCNA
Versions per branch
Neither OSV.dev nor the vendor advisories we read list affected versions for CVE-2026-38601 yet.
Fix
No fix published by the sources we read yet. NVD record
Detection
- Nuclei template
- none so far ProjectDiscovery
- Exploit-DB
- no entry Exploit-DB
- Proof of concept
- CISA-ADP (SSVC)PoC stated2026-11-09
- PoC-in-GitHubno public repository identifiedread 2026-11-08
- Metasploit modules
- none listed Metasploit Framework
Sources
- NVDCVE recordread 2026-11-09
- CISA-ADPSSVC decisionpoc2026-11-09
- CISA-ADPCVSS 3.17.52026-11-09
- CISA-ADPweakness (CWE)CWE-7982026-11-09
- FIRST EPSSEPSS score0.2 %2026-11-08
- GitHub Advisoriesadvisory—
Identifiers
- EUVD-2026-116105same flawENISA EUVD · LicenseRef-ENISA-legal-notice
- GHSA-wmj3-p5xf-h898same flawGitHub Advisory Database · CC-BY-4.0
Technical details
- CVSS v3 Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Published
- 2026-11-03
- Last Modified
- 2026-11-09
- NVD status
- Received
- GitHub Advisory
- GHSA-wmj3-p5xf-h898
Frequently asked questions
What is CVE-2026-38601?
Is CVE-2026-38601 actively exploited?
What is the CVSS score for CVE-2026-38601?
Hear about the next vulnerability in your software
Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».
No credit card required · No monthly cap on website lookups · 250 API requests/month
Go further
- Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
- Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.
Related vulnerabilities
Same product first, then the same vendor advisory and the same publication week.
- CVE-2026-116779KEVsame weekFreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
- CVE-2026-123158KEVsame weekOpenSSH Password Authentication Bypass on Musl Linux
- CVE-2026-118527KEVsame week
- CVE-2026-19868KEVsame week
- CVE-2026-102895KEVsame weekGPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
- CVE-2026-77690same weekCommand injection vulnerability
- CVE-2026-121943same weekIrontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet
- CVE-2026-119742same weekNagios XI < 2026R2 OS Command Injection via mibs.php
Sources for this record
- CVE Program · CVE Program Terms of Use
- ENISA EU Vulnerability Database · ENISA legal notice §1.2 (reproduction authorised, provided the source is acknowledged)
- FIRST EPSS · EPSS terms of use (free use, attribution requested)
- GitHub Advisory Database · CC-BY-4.0 · GHSA-wmj3-p5xf-h898
- NVD · Public domain (17 U.S.C. § 105) for NVD-authored data; third-party content under its own terms
- OpenCVE · OpenCVE terms of service · terms restrict redistribution
- CISA Vulnrichment · CC0-1.0