CVE-2020-36911
Covenant 0.5 - Remote Code Execution (RCE)
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jan 13, 2026
- Updated
- May 14, 2026
- Reserved
- Jan 3, 2026
Description
Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
CovenantCobbr |
|
References
- ExploitDB-51141exploit
- Vendor Homepageproduct
- Covenant GitHub Repositoryproduct
- Archived Researcher Blogtechnical-descriptionexploit
- Exploit Repositoryexploit
- Archived Maintainer Patch Announcementvendor-advisorypatch
- VulnCheck Advisory: Covenant 0.5 - Remote Code Execution (RCE)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.