Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.
References
| Link | Resource |
|---|---|
| https://cobbr.io/Covenant.html | Broken Link |
| https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb | Product |
| https://github.com/cobbr/Covenant | Product |
| https://web.archive.org/web/20201013165001/https://twitter.com/cobbr_io/status/1316058367161401344 | Issue Tracking |
| https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/51141 | Exploit |
| https://www.vulncheck.com/advisories/covenant-remote-code-execution-rce | Third Party Advisory |
| https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb | Product |
| https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters | Exploit Third Party Advisory |
Configurations
History
29 Jan 2026, 00:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cobbr.io/Covenant.html - Broken Link | |
| References | () https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb - Product | |
| References | () https://github.com/cobbr/Covenant - Product | |
| References | () https://web.archive.org/web/20201013165001/https://twitter.com/cobbr_io/status/1316058367161401344 - Issue Tracking | |
| References | () https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/51141 - Exploit | |
| References | () https://www.vulncheck.com/advisories/covenant-remote-code-execution-rce - Third Party Advisory | |
| First Time |
Cobbr
Cobbr covenant |
|
| CPE | cpe:2.3:a:cobbr:covenant:*:*:*:*:*:*:*:* |
14 Jan 2026, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb - | |
| References | () https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters - |
13 Jan 2026, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-13 23:15
Updated : 2026-01-29 00:56
NVD link : CVE-2020-36911
Mitre link : CVE-2020-36911
CVE.ORG link : CVE-2020-36911
JSON object : View
Products Affected
cobbr
- covenant
CWE
CWE-798
Use of Hard-coded Credentials