CVE-2020-36911 Covenant 0.5 - Remote Code Execution (RCE)
Attackers can forge JWT tokens using hardcoded credentials to gain admin access and execute arbitrary code on Covenant servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36911?
CVE-2020-36911 is a critical vulnerability in Cobbr Covenant, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.
Weakness: CWE-798
Which versions are affected by CVE-2020-36911?
It affects 1 product.
Products include Cobbr Covenant.
How do I fix CVE-2020-36911?
No fix has been published for CVE-2020-36911 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36911 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36911 exists.
Sources
Also known as GHSA-pfjr-8v62-gmm9.