Listen to this Post
CVE-2026-82410 is a high-severity denial-of-service vulnerability affecting PocketBase, an open-source Go backend framework that combines an embedded SQLite database, authentication, file storage, and an admin UI/API into a single binary. The vulnerability arises from a fundamental gap in PocketBase’s panic-recovery mechanism. While the framework already includes built-in panic-recover middleware for regular HTTP request handling, this middleware does not extend to internal child and worker goroutines spawned by the application. In Go, the runtime isolates goroutines such that an unrecovered panic in any goroutine terminates the entire process, not merely the offending goroutine. This architectural characteristic means that when an unexpected panic occurs inside one of PocketBase’s internal worker goroutines, the recovery middleware fails to catch it, and the panic propagates unhandled, crashing the entire server process. The vulnerability is remotely triggerable over the network, requires no authentication, and needs no user interaction, giving it a low attack complexity. The CVSS score assigned to this vulnerability is 8.7, classified as High severity. The issue is tracked under CWE-248 (Uncaught Exception). The vulnerability was reported by @gigioneggiando and affects PocketBase versions prior to 0.22.48 and versions 0.23.0 through 0.39.6. The remediation introduces a new helper called routine.SafeWrap, which auto-recovers and returns any eventual panic as a regular error, and this wrapper is applied to all existing internal worker functions. The fix was released in PocketBase v0.39.7 and backported to v0.22.48 for users on older versions. Any internet-exposed PocketBase instance within the affected version range is at risk of a complete service outage until the process is restarted.
DailyCVE Form:
Platform: PocketBase Go backend
Version: < 0.22.48, 0.23.0–0.39.6
Vulnerability: Unhandled goroutine panic
Severity: High (8.7)
date: September 16, 2026
Prediction: September 17, 2026
What Undercode Say:
Analytics:
Check installed PocketBase version ./pocketbase --version Check Go module dependency version grep pocketbase go.mod Identify affected versions via dependency tree go list -m all | grep pocketbase Check release notes for fix curl -s https://api.github.com/repos/pocketbase/pocketbase/releases/tags/v0.39.7 Verify SafeWrap presence in codebase grep -r "SafeWrap" --include=".go" . Monitor process for unexpected termination while true; do pgrep pocketbase || echo "CRASHED"; sleep 5; done Check system logs for panic traces journalctl -u pocketbase | grep -i "panic" Extract goroutine stack from crash dump dlv core ./pocketbase core.dump --headless --listen=:2345
Exploit: (Educational Purposes!)
The following demonstrates the conceptual exploitation path for educational purposes only. This vulnerability allows a remote, unauthenticated attacker to trigger a panic inside an internal worker goroutine. The attacker must identify an application endpoint or scheduled task that internally spawns a worker goroutine and processes attacker-influenced data without proper input validation. Once a panic is induced in the worker goroutine, the Go runtime terminates the entire PocketBase process, resulting in a full denial of service. The exploit requires no special privileges and can be repeated to maintain the service outage. Security researchers should use this knowledge solely to understand the attack surface and verify patches in controlled laboratory environments.
Protection: from this CVE
Immediate action: Upgrade PocketBase to version 0.22.48 (for the 0.22.x line) or version 0.39.7 (for later releases). These versions wrap all internal worker functions with the routine.SafeWrap helper, which recovers panics and converts them into regular errors instead of allowing them to crash the process. If immediate patching is not possible, place PocketBase instances behind a process supervisor or orchestrator configured for automatic restart on crash, and restrict network exposure of the service to trusted sources to reduce the window for repeated exploitation until the upgrade is applied. There is no supported workaround that fully prevents the underlying unhandled panic.
Impact:
Successful exploitation results in the termination of the running PocketBase server process, causing a complete denial of service. All functionality becomes unavailable, including API endpoints, authentication services, file storage access, and the admin UI. The impact is limited strictly to availability, with no effect on confidentiality or integrity of data. Recovery requires manual intervention or an automated supervisor to restart the process. Repeated exploitation can maintain a persistent outage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
