/
← Voltar ao feed
high

CVE-2026-0265: PAN-OS GlobalProtect CAS JWT algorithm confusion allows authentication bypass and VPN access

1 fonte(s) · 1 atualização(ões) · publicado 19/05/2026 21:00 · coletado há 1 dia

Researcher Harsh Jaiswal (Hacktron) disclosed an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect when Cloud Authentication Service (CAS) is enabled, tracked as CVE-2026-0265. With help from Claude and Ghidra MCP, he found that the firewall's JWT verification trusts the alg field in the token header. An attacker can therefore forge a token signed with HS256 that uses the public CAS signing certificate as the HMAC secret. The researcher says he built a working exploit that hijacks the GlobalProtect login and connects to the VPN knowing only a username, typically the user's email address. He withheld the full exploit chain because some organizations may still be exposed, and urges customers on older PAN-OS versions with CAS enabled to update immediately.

Technical Details

  • pan_jwt_verify passes the alg value from the parsed JWT header straight into pan_auth_verify. That function dispatches purely on the string, with no cross-check against the key type. For HS256/HS384/HS512 it uses the certificate bytes as the HMAC secret (_verify_sha_hmac). Otherwise it takes the asymmetric RSA/EC path (_verify_sha_pem).
  • The CAS token-signing certificates are public. They can be fetched from the CAS metadata endpoint /api/v1/metadata, which is protected by mTLS with device certificates. The researcher obtained those device certs by hooking the underlying crypto functions on the VM.
  • The forged JWT's aud claim needs the target's CSP ID. The device serial number (SN claim) leaks in the outbound JWT returned by GET /global-protect/login.esp. The serial can then be queried against the Palo Alto license API (license.api.paloaltonetworks.com/entitlements/v1/device?serialNumber=<SN>) with any valid mTLS client certificate. The response includes support_account_id.
  • The research environment was a PAN-OS VM-Series AWS Marketplace AMI. The researcher copied the EBS snapshot through the EBS Direct APIs to strip the product code, then gained root on a running instance.
  • The article does not state active in-the-wild exploitation, and the full exploit has not been published. The article only points to the Palo Alto advisory and CVE record without quoting fixed versions.

Remediation

  • Update PAN-OS to a release fixed for CVE-2026-0265 per the Palo Alto Networks security advisory, especially where CAS authentication is enabled for GlobalProtect.
  • Review GlobalProtect authentication logs for unexpected logins on CAS-enabled portals.

Linha do tempo

  1. hacktron.ai ↗ · pub. 19/05/2026 21:00 · coletado 19/10 18:03 primeiro registro

    CVE-2026-0265: PAN-OS GlobalProtect CAS JWT algorithm confusion allows authentication bypass and VPN access

    ler a análise desta fonte

    Researcher Harsh Jaiswal (Hacktron) disclosed an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect when Cloud Authentication Service (CAS) is enabled, tracked as CVE-2026-0265. With help from Claude and Ghidra MCP, he found that the firewall's JWT verification trusts the alg field in the token header. An attacker can therefore forge a token signed with HS256 that uses the public CAS signing certificate as the HMAC secret. The researcher says he built a working exploit that hijacks the GlobalProtect login and connects to the VPN knowing only a username, typically the user's email address. He withheld the full exploit chain because some organizations may still be exposed, and urges customers on older PAN-OS versions with CAS enabled to update immediately.

    Technical Details

    • pan_jwt_verify passes the alg value from the parsed JWT header straight into pan_auth_verify. That function dispatches purely on the string, with no cross-check against the key type. For HS256/HS384/HS512 it uses the certificate bytes as the HMAC secret (_verify_sha_hmac). Otherwise it takes the asymmetric RSA/EC path (_verify_sha_pem).
    • The CAS token-signing certificates are public. They can be fetched from the CAS metadata endpoint /api/v1/metadata, which is protected by mTLS with device certificates. The researcher obtained those device certs by hooking the underlying crypto functions on the VM.
    • The forged JWT's aud claim needs the target's CSP ID. The device serial number (SN claim) leaks in the outbound JWT returned by GET /global-protect/login.esp. The serial can then be queried against the Palo Alto license API (license.api.paloaltonetworks.com/entitlements/v1/device?serialNumber=<SN>) with any valid mTLS client certificate. The response includes support_account_id.
    • The research environment was a PAN-OS VM-Series AWS Marketplace AMI. The researcher copied the EBS snapshot through the EBS Direct APIs to strip the product code, then gained root on a running instance.
    • The article does not state active in-the-wild exploitation, and the full exploit has not been published. The article only points to the Palo Alto advisory and CVE record without quoting fixed versions.

    Remediation

    • Update PAN-OS to a release fixed for CVE-2026-0265 per the Palo Alto Networks security advisory, especially where CAS authentication is enabled for GlobalProtect.
    • Review GlobalProtect authentication logs for unexpected logins on CAS-enabled portals.