FERRY · CVE-2026-127281 · Other
NO FIX YET · SEE WHAT TO DO
Ferry (lanyulei/ferry) 1.0.0 and 1.0.0-beta.1 accept forged JWTs. The reporter says that when settings.jwt.secret is unset the secret is an empty string the middleware does not reject, and the default config ships jwt.secret: ferry. The permission middleware also trusts the token's rolekey claim without checking the database, so a forged token with rolekey admin gives admin rights. VulDB reports a public PoC and no vendor response; the GitHub issue (#343) is still open with no maintainer reply.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run lanyulei Ferry 1.0.0-beta.1 or 1.0.0 with its JWT-based auth middleware exposed to a network. The sources do not say whether a default configuration is affected or whether other versions are safe. Deployments that do not run these versions can skip it.
Not affected if custom-jwt-secret, not-internet-exposed, other-versions
Who cares auth-bypass, ferry, go, jwt, self-hosted
1.0.0 or 1.0.0-beta.1ferry (the shipped default), you are exposedPosts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was found in lanyulei ferry 1.0.0-beta.1/1.0.0. Affected is an unknown function of the file middleware/auth.go of the component JWT Validation. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.