Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-125370

Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Kubero-dev
Products
Kubero
CVE-2026-92720

Kubero through 3.1.1 Unauthenticated Notifications API Access

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Kubero-dev
Products
Kubero