Is CVE-2026-34581 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34581 being exploited in the wild.

How severe is CVE-2026-34581?

High severity, with a CVSS score of 8.1, published 2 April 2026.

Which products and versions are affected?

github.com/patrickhener/goshs (Go) SEMVER:introduced=1.1.0.

Is there a fix for CVE-2026-34581?

A patch was published on 2026-03-30: Version 2.0.0-beta.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34581 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34581?

Check whether you run github.com/patrickhener/goshs (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34581: Patrickhener goshs authentication bypass via Share Token

CVE-2026-34581 · Severity: high · CVSS 8.1 · Published 2026-04-02

goshs is a simple web server used to share files and provide remote command-line access. A security flaw allows anyone with a valid "share token"—normally used only to download a specific file—to bypass all security checks and gain full control over the server. This could allow an attacker to steal sensitive data, delete files, or execute malicious commands on the host system.

Technologies: github.com/patrickhener/goshs (Go). Vendors: Go.

Quick answers

Is CVE-2026-34581 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34581 being exploited in the wild.
How severe is CVE-2026-34581?: High severity, with a CVSS score of 8.1, published 2 April 2026.
Which products and versions are affected?: github.com/patrickhener/goshs (Go) SEMVER:introduced=1.1.0.
Is there a fix for CVE-2026-34581?: A patch was published on 2026-03-30: Version 2.0.0-beta.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34581 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34581?: Check whether you run github.com/patrickhener/goshs (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass exists in the BasicAuthMiddleware of goshs due to improper validation logic. The middleware prioritizes checking for a '?token=' parameter; if a valid share token (intended for single-file access) is present, the middleware grants full access and skips subsequent authentication checks. An attacker with a valid share token can append additional query parameters, such as '?ws', to upgrade the connection to a WebSocket. This grants access to restricted features including directory listings, file deletion, and CLI command execution if the module is enabled. The issue is fixed in version 2.0.0-beta.2.

Affected products

patrickhener goshs >= 1.1.0, < 2.0.0-beta.2

Identifiers

CVE-2026-34581
GHSA-jgfx-74g2-9r6g
GO-2026-5469

Timeline

2026-03-30: advisory: Vendor advisory published on GitHub
2026-03-30: patched: Version 2.0.0-beta.2 released
2026-04-02: disclosed: CVE-2026-34581 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.