7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26201

CVE-2026-26201: emp3r0r Affected by Concurrent Map Access DoS (panic/crash)

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 3.21.2, multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger fatal error: concurrent map read and map write, causing C2 process crash (availability loss). Version 3.21.2 fixes this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26201

CVE-2026-26201:

7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/jm33-m0/emp3r0r/core	go	< 0.0.0-20260212232424-ea4d074f081d	0.0.0-20260212232424-ea4d074f081d

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-f5p9-j34q-pwcc, is a classic race condition in Go due to concurrent access to shared maps without proper and consistent synchronization. The application uses several global maps (e.g., OPERATORS, PortFwds, FTPStreams, AgentControlMap) to manage state for operator sessions, port forwards, file transfers, and connected agents.

The root cause is that multiple goroutines read from and write to these standard Go maps simultaneously. For instance, one goroutine might be iterating over the OPERATORS map to broadcast a message, while another goroutine is adding or removing an operator from the same map as they connect or disconnect. Standard Go maps are not safe for concurrent access, and such operations will cause the Go runtime to detect the conflict and trigger a fatal error: concurrent map read and map write, crashing the entire C2 server process. This results in a Denial of Service (DoS).

The patch addresses this vulnerability by replacing the usage of standard map types with sync.Map for all the affected shared resources. sync.Map is a thread-safe map implementation provided by Go's standard library, specifically designed for concurrent read and write access. By migrating to sync.Map, the application ensures that all operations on these shared maps are atomic, thus eliminating the race conditions and preventing the server from crashing under concurrent activity.

Vulnerable functions

fwdMsg2Operators

core/internal/cc/server/handler_messagetun_helper.go

This function iterates over the shared `OPERATORS` map without a lock. Concurrently, the `handleOperatorConn` function can add or remove entries from the same map, leading to a 'concurrent map read and map write' fatal error.

handleOperatorConn

core/internal/cc/server/operator.go

This function writes to and deletes from the shared `OPERATORS` map without a consistent lock. Other goroutines, such as in `fwdMsg2Operators`, can be reading from this map simultaneously, causing a race condition and a server crash.

handleListPortFwds

core/internal/cc/server/operator.go

This function iterates over the `network.PortFwds` map. This read operation is not synchronized with write operations in other functions like `RunPortFwd` or `RemoveForward`, leading to a potential race condition.

RemoveForward

core/internal/cc/controllers/portfwd.go

This function iterates over and deletes from the `network.PortFwds` map. These operations are not synchronized with other concurrent reads or writes to the same map, causing a race condition.

RunPortFwd

core/internal/cc/base/network/portfwd_session.go

This function writes to and deletes from the `network.PortFwds` map without proper locking. Concurrent reads, like in `handleListPortFwds`, can cause a 'concurrent map read and map write' panic.

dispatcher

core/internal/cc/base/relay/server.go

The function iterates over the `network.FTPStreams` map to find a matching stream. This read operation is not synchronized with concurrent write operations on the same map from functions like `GetFile` or `HandleFTPTransfer`, leading to a race condition.

HandleFTPTransfer

core/internal/cc/base/ftp/handler_ftp.go

This function both iterates over and deletes from the `network.FTPStreams` map. These operations are not synchronized with other functions accessing the map, causing a high risk of a 'concurrent map read and map write' panic.

GetFile

core/internal/cc/base/ftp/file_transfer.go

This function writes to the `network.FTPStreams` map. The original implementation used a mutex, but the vulnerability description implies that locking was inconsistent across the application. Concurrent iteration in functions like `dispatcher` or `HandleFTPTransfer` without acquiring the same lock would cause a race condition. The fix replaces this with `sync.Map` to ensure thread safety.

DisconnectAllAgents

core/internal/cc/base/agents/disconnect.go

This function iterates over the `live.AgentControlMap`. This map is modified concurrently by various agent lifecycle operations (e.g., check-ins in `handleAgentCheckIn`), and the unsynchronized access can lead to a panic.

handleAgentCheckIn

core/internal/cc/server/handler_checkin.go

This function performs numerous unsynchronized read and write operations on `live.AgentControlMap` and `live.PendingKeyRotations` to manage agent state. High-frequency check-ins from multiple agents would likely trigger a 'concurrent map read and map write' error.

handleMessageTunnel

core/internal/cc/server/handler_messagetun.go

This function iterates over and deletes from `live.AgentControlMap` when an agent disconnects. These modifications are not synchronized with other functions that read or write to the same map, such as `handleAgentCheckIn`, creating a race condition.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.