CVE-2026-33746: JWT Forgery in Convoy Panel

The impact of CVE-2026-33746 is severe. An attacker can craft malicious JWT tokens with altered payloads, specifically targeting the user_uuid claim. By successfully forging these tokens, an attacker could impersonate legitimate users, escalate privileges, and gain complete control over the Convoy Panel. This could lead to unauthorized access to managed KVM servers, data breaches, and potentially complete compromise of the hosting infrastructure. The lack of signature verification means that even if the token's time-based claims (exp, nbf, iat) are valid, a malicious actor can modify the payload without detection. This vulnerability shares similarities with other JWT-related vulnerabilities where improper validation leads to authentication bypass.

1. Reserved2026-03-23
2. Published2026-04-02
3. EPSS updated2026-04-10

The primary mitigation for CVE-2026-33746 is to immediately upgrade Convoy Panel to version 4.5.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct workaround is difficult without modifying the Convoy Panel code, implementing a reverse proxy or Web Application Firewall (WAF) with JWT validation capabilities before the Convoy Panel can provide an additional layer of defense. Configure the WAF to strictly validate JWT signatures and reject any tokens that fail verification. Monitor Convoy Panel logs for suspicious JWT activity, such as unexpected user IDs or frequent token re-issuance. After upgrading, confirm the fix by attempting to forge a JWT token and verifying that it is rejected by the system.