CVE-2026-87816: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in pglombardo PasswordPusher
Affects pglombardo PasswordPusherSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEs
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| pglombardoPasswordPusher | Affected
| Fixed in
|
GitHub Actionspglombardo/PasswordPusherpkg:github/pglombardo/PasswordPusherOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is available, consider implementing application-level request serialization or rate limiting on the show endpoint to reduce the risk of concurrent access bypass.
Description
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
Summary
CVE-2026-87816 is a race condition vulnerability in PasswordPusher prior to version 2.11.1. The vulnerability arises from improper synchronization when enforcing the expire_after_views limit on one-time secrets. Attackers can exploit this by issuing concurrent requests to the show endpoint, allowing them to access the secret multiple times before the view count is updated and the secret expires, effectively bypassing the intended access restrictions.
Impact
An unauthenticated attacker can bypass the expire_after_views limit on one-time secrets, potentially accessing sensitive information multiple times despite intended single-use restrictions. This undermines the confidentiality guarantees of PasswordPusher's secret sharing functionality.
References
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.