Live › vulnerability › CVE-2026-38601
The gohttpserver file server ships with a hardcoded session secret key in versions through 1.3.0. An attacker can forge session cookies to impersonate any user and bypass OpenID Connect login.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Anyone running gohttpserver 1.3.0 or earlier with OpenID login enabled. The session cookie store is signed with a hardcoded key published in the source, so an attacker can forge a ghs-session cookie and impersonate a user, which can include upload or delete rights tied to a user's email in .ghs.yml. Instances that use no login or only HTTP basic auth do not rely on the cookie for login and can mostly skip this, though the cookie store is shared by the access checks.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| codeskyblue/gohttpserver | go | <= 1.3.0 | – |
1.3.0, including the codeskyblue/gohttpserver Docker image) with OpenID login enabled? You are exposed1.3.0 is the latest releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.
This page as .md · .json · in your agent: get_signal("CVE-2026-38601")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.