CVE-2026-125370

CriticalCVSS 9.8

Published: 10/11/2026(UTC)Updated: 10/11/2026(UTC)Translated: 10/11/2026(UTC)NVD NIST

Summary

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

Risk Assessment

An attacker can gain administrative privileges and take control of Kubero resources, including pipelines and applications. The risk is high if JWT_SECRET is not configured.

Recommendation

Update Kubero to a version later than 3.1.1 and set a unique, strong JWT_SECRET. Verify that no unauthorized access occurred.

Other vulnerabilities in Kubero

CVE-2026-92720Critical
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS