---
id: "CVE-2026-127281"
page: "https://infrastack.ai/live/CVE-2026-127281"
kind: "vulnerability"
aliases: ["CVE-2026-127281"]
title: "Ferry: forged JWT (empty or default secret) gives admin access; no fix"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ferry", "fixed": [], "affected": "1.0.0-beta.1, 1.0.0", "ecosystem": "go"}]
ecosystems: []
tags: ["auth-bypass", "ferry", "go", "jwt", "other", "self-hosted"]
not_affected_if: ["custom-jwt-secret", "not-internet-exposed", "other-versions"]
published_at: "2026-11-13T02:18:55+00:00"
first_seen_at: "2026-11-13T02:41:36+00:00"
updated_at: "2026-11-13T02:46:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127281", "first_seen_at": "2026-11-13T02:41:36+00:00"}, {"source": "analyst", "url": "https://github.com/lanyulei/ferry/issues/343", "first_seen_at": "2026-11-13T02:46:30+00:00", "cites": ["https://github.com/lanyulei/ferry/issues/343", "https://vuldb.com/vuln/436447"]}]
exploit_sources: []
---

# Ferry: forged JWT (empty or default secret) gives admin access; no fix

Link for people: https://infrastack.ai/live/CVE-2026-127281 (this .md is for agents)

Ferry (lanyulei/ferry) 1.0.0 and 1.0.0-beta.1 accept forged JWTs. The reporter says that when settings.jwt.secret is unset the secret is an empty string the middleware does not reject, and the default config ships jwt.secret: ferry. The permission middleware also trusts the token's rolekey claim without checking the database, so a forged token with rolekey admin gives admin rights. VulDB reports a public PoC and no vendor response; the GitHub issue (#343) is still open with no maintainer reply.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:ferry affected 1.0.0-beta.1, 1.0.0 fixed no fixed version listed

## How to check

Check whether you run Ferry 1.0.0 or 1.0.0-beta.1. In your config (settings.yml) look at settings.jwt.secret: if it is empty or 'ferry' (the shipped default), you are exposed. Also check middleware/permission.go for a subject taken straight from the token's rolekey claim.

## Fix

unknown: no patched version found; the maintainer has not answered issue #343 or VulDB. Workaround: set a long random settings.jwt.secret (and restart, which invalidates old tokens), and do not expose Ferry to the internet.

## Timeline

- 2026-11-13T02:41:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127281
- 2026-11-13T02:46:30+00:00 analyst https://github.com/lanyulei/ferry/issues/343 — Read reporter issue #343 and VulDB; no maintainer fix or advisory found; fix-status none not verified from vendor page so left unmarked; NVD page returned empty.

## Documents

- [advisory] Ferry #343: JWT empty secret and trusted rolekey claim allow auth bypass https://github.com/lanyulei/ferry/issues/343
- [describes] VDB-436447 lanyulei ferry JWT Validation improper authentication https://vuldb.com/vuln/436447

## From the sources

A vulnerability was found in lanyulei ferry 1.0.0-beta.1/1.0.0. Affected is an unknown function of the file middleware/auth.go of the component JWT Validation. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_