CVE-2020-36911

Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cobbr.io/Covenant.html
https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb
https://github.com/cobbr/Covenant
https://web.archive.org/web/20201013165001/https://twitter.com/cobbr_io/status/1316058367161401344
https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters
https://www.exploit-db.com/exploits/51141
https://www.vulncheck.com/advisories/covenant-remote-code-execution-rce
https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb
https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters

Configurations

No configuration.

History

14 Jan 2026, 20:15

Type	Values Removed	Values Added
References	~~() https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb -~~	() https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb -
References	~~() https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters -~~	() https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters -

13 Jan 2026, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-13 23:15

Updated : 2026-01-14 20:15

NVD link : CVE-2020-36911

Mitre link : CVE-2020-36911

CVE.ORG link : CVE-2020-36911

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2020-36911", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-13T23:15:48.437", "references": [{"url": "https://cobbr.io/Covenant.html", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/cobbr/Covenant", "source": "disclosure@vulncheck.com"}, {"url": "https://web.archive.org/web/20201013165001/https://twitter.com/cobbr_io/status/1316058367161401344", "source": "disclosure@vulncheck.com"}, {"url": "https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/51141", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/covenant-remote-code-execution-rce", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system."}], "lastModified": "2026-01-14T20:15:51.050", "sourceIdentifier": "disclosure@vulncheck.com"}