Security readout for executives and security teams
Plain-English summary
CVE-2026-3209 is an access-control flaw in fosrl Pangolin’s role handling. A logged-in remote actor may be able to perform actions outside their intended permissions. Public exploit information exists, but the provided sources do not show confirmed active exploitation. Organizations running affected Pangolin versions should prioritize upgrading to the vendor’s fixed release.
Executive priority
Treat this as a near-term remediation item, not an emergency unless Pangolin is exposed to many users or untrusted accounts. The risk is meaningful because authorization flaws can undermine tenant or role boundaries, and public exploit information lowers the barrier for misuse.
Technical view
The issue affects verifyRoleAccess and verifyApiKeyRoleAccess in Pangolin’s Role Handler, causing improper access controls. VulDB rates it CVSS 6.5 with network access, low complexity, and required authentication. The CVE description says versions up to 1.15.4-s.3 are affected and 1.15.4-s.4 mitigates the issue via commit 5e37c4e85fae68e756be5019a28ca903b161fdd5.
Likely exposure
Exposure is limited to deployments of fosrl Pangolin running vulnerable 1.15.4-s builds, especially where authenticated users or API keys exist. The source bundle lists 1.15.4-s.0 through s.3 as affected in the description, while the affected version list also includes s.4; this inconsistency should be resolved against vendor release notes.
Exploitation context
Remote exploitation is described as possible and public exploit material is referenced. Authentication is required per the CVSS vector, reducing broad internet drive-by risk. There is no KEV listing and no cited source confirms active exploitation in the wild.
Researcher notes
Key evidence comes from VulDB, CVE metadata, GitHub PR 2511, the patch commit, and the 1.15.4-s.4 release. The provided sources establish a public exploit reference but not active exploitation. Version data contains an inconsistency around whether 1.15.4-s.4 is affected or fixed.
Mitigation direction
- Upgrade Pangolin to 1.15.4-s.4 or later per vendor guidance.
- Review vendor release notes and patch commit for deployment-specific impact.
- Rotate or review API keys if unauthorized role access is suspected.
- Restrict Pangolin access to trusted networks where operationally feasible.
Validation and detection
- Inventory Pangolin deployments and record exact versions.
- Confirm vulnerable instances are upgraded to 1.15.4-s.4 or later.
- Review role and API-key permissions for unexpected privilege assignments.
- Check application logs for unusual authenticated role or API-key activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3209 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- VDB-347796 | fosrl Pangolin Role verifyApiKeyRoleAccess access controlCVE reference · vdb-entry, technical-description
- VDB-347796 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #765676 | Pangolin <=1.15.4 Improper Access ControlsCVE reference · third-party-advisory
- Submit #766215 | Pangolin (https://pangolin.net/) Pangolin Project (https://github.com/fosrl/pangolin) <=1.15.4 Improper Access Controls (Duplicate)CVE reference · third-party-advisory
- https://gist.github.com/henrrrychau/0457bef6776d0c99688f9cf55cdf55f7CVE reference · exploit
- https://github.com/fosrl/pangolin/pull/2511CVE reference · issue-tracking, patch
- https://github.com/fosrl/pangolin/commit/5e37c4e85fae68e756be5019a28ca903b161fdd5CVE reference · patch
- https://github.com/fosrl/pangolin/releases/tag/1.15.4-s.4CVE reference · patch
- https://github.com/fosrl/pangolin/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.