CVE-2020-12666

gopkg.in/macaron.v1 Open Redirect vulnerability

6.1 MediumFix available

macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.41%Up 0.6 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.

Record: CVE-2020-12666
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-601
Updated: 2026-11-02

CVE List No score

macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.

Record: CVE-2020-12666
Updated: 2026-11-02

EUVDEUVD-2021-0982 No score

macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.

Record: EUVD-2021-0982
Updated: 2026-11-03

GitHub AdvisoriesGHSA-733f-44f3-3frw 6.1

gopkg.in/macaron.v1 Open Redirect vulnerability

macaron before 1.3.7 has an open redirect in the static handler. Due to improper request santization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.

Record: GHSA-733f-44f3-3frw
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-601
Updated: 2026-11-02

OSV 6.1

macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.

Record: CVE-2020-12666
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-733f-44f3-3frw 6.1

gopkg.in/macaron.v1 Open Redirect vulnerability

Record: GHSA-733f-44f3-3frw
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-601
Updated: 2026-11-02

OSVRHSA-2020:3369 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update

Record: RHSA-2020:3369
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGO-2020-0039 No score

Open redirect in gopkg.in/macaron.v1

Due to improper request sanitization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.

Record: GO-2020-0039
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`gopkg.in/macaron.v1` Go	before 1.3.7	1.3.7
`kiali` Red Hat:service_mesh:1.1::el7 From an advisory covering 5 CVEs	before 0:v1.12.10.redhat2-1.el7	0:v1.12.10.redhat2-1.el7
`ior` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh-citadel` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh-cni` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh-galley` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh-grafana` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:6.4.3-13.el8	0:6.4.3-13.el8
`servicemesh-grafana-prometheus` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:6.4.3-13.el8	0:6.4.3-13.el8
`servicemesh-istioctl` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`servicemesh-mixc` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh-mixs` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh-operator` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-2.el8	0:1.1.6-2.el8
`servicemesh-pilot-agent` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh-pilot-discovery` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8
`servicemesh-prometheus` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:2.14.0-14.el8	0:2.14.0-14.el8
`servicemesh-sidecar-injector` Red Hat:service_mesh:1.1::el8 From an advisory covering 5 CVEs	before 0:1.1.6-1.el8	0:1.1.6-1.el8

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12666 is a medium vulnerability (CVSS 6.1) in Go-macaron Macaron, published May 5, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in gopkg.in/macaron.v1 1.3.7.

References

Show 33 moreShow less