Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users

The impact of CVE-2026-33746 is severe. An attacker who successfully exploits this vulnerability can forge JWT tokens, effectively impersonating any user within the Convoy Panel system. This includes administrators, allowing complete control over the panel's configuration and hosted virtual machines. Attackers could modify user UUIDs within the JWT payload to gain access to sensitive data or perform unauthorized actions on behalf of other users. The lack of signature verification means that even a slightly modified token will be accepted as valid, making detection difficult without specific monitoring. This vulnerability shares similarities with other JWT-related vulnerabilities where improper validation leads to authentication bypass.

Hosting businesses utilizing Convoy Panel to manage their KVM infrastructure are at significant risk. Specifically, deployments using older versions (3.9.0-beta through 4.5.0) are vulnerable. Shared hosting environments where multiple users share a single Convoy Panel instance are particularly exposed, as a compromise of one user's account could lead to broader system access.

• linux / server:

journalctl -u convoy-panel | grep -i "JWT decode failed"

• generic web:

curl -I <convoy_panel_url>/api/v1/users/me | grep -i "Authorization: Bearer"

Inspect the Authorization header for malformed or suspicious JWT tokens. • generic web: Review Convoy Panel access logs for unusual user agent strings or IP addresses attempting to access sensitive endpoints.

1. 2026-04-02Disclosure

   disclosure

2. 2026-04-03CISA KEV

   kev

1. Reserviert2026-03-23
2. Veröffentlicht2026-04-02
3. EPSS aktualisiert2026-04-10

The primary mitigation for CVE-2026-33746 is to immediately upgrade Convoy Panel to version 4.5.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. While not a complete solution, restricting network access to the Convoy Panel to trusted sources can reduce the attack surface. Implement strict input validation on all user-supplied data to minimize the potential for payload manipulation. Monitor JWT logs for unusual activity or suspicious token patterns. Consider using a Web Application Firewall (WAF) with JWT validation capabilities to detect and block malicious requests. After upgrading, confirm the fix by attempting to forge a JWT token and verifying that it is rejected by the system.