---
id: "CVE-2026-82410"
kind: "vulnerability"
aliases: ["CVE-2026-82410", "GHSA-84vh-m24q-wjjx", "GO-2026-6489"]
title: "Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase"
severity: "high"
cvss: 8.7
epss: 0.00577
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/pocketbase/pocketbase", "fixed": ["0.22.48", "0.39.7"], "affected": ">= 0.23.0, < 0.39.7", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "package", "pocketbase", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-09-16T15:17:54+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:44:01+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6489", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-82410", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82410", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase

PocketBase's panic recovery does not cover its internal child and worker goroutines, so a panic there crashes the whole server process. An attacker who can trigger such a panic can take the backend offline (denial of service).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/pocketbase/pocketbase affected >= 0.23.0, < 0.39.7 fixed 0.22.48, 0.39.7

## How to check

grep pocketbase go.mod to see the pinned version; versions below 0.22.48 (0.22 line) or below 0.39.7 are affected per the description

## Fix

Upgrade to 0.22.48 (0.22 line) or 0.39.7 (0.39 line), which add routine.SafeWrap around the affected worker functions.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6489
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-82410
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82410

## From the sources

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_