CVE-2026-25538

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25538", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T19:59:47.374Z", "datePublished": "2026-02-04T21:37:04.483Z", "dateUpdated": "2026-02-05T18:37:58.750Z"}, "containers": {"cna": {"title": "Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2"}, {"name": "https://github.com/devtron-labs/devtron/commit/d2b0d260d858ab1354b73a8f50f7f078ca62706f", "tags": ["x_refsource_MISC"], "url": "https://github.com/devtron-labs/devtron/commit/d2b0d260d858ab1354b73a8f50f7f078ca62706f"}], "affected": [{"vendor": "devtron-labs", "product": "devtron", "versions": [{"version": "<= 2.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T21:37:04.483Z"}, "descriptions": [{"lang": "en", "value": "Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26."}], "source": {"advisory": "GHSA-8wpc-j9q9-j5m2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T18:37:54.919579Z", "id": "CVE-2026-25538", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T18:37:58.750Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25538", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-05T18:37:54.919579Z"}}}], "references": [{"url": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T18:37:42.562Z"}}], "cna": {"title": "Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage", "source": {"advisory": "GHSA-8wpc-j9q9-j5m2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "devtron-labs", "product": "devtron", "versions": [{"status": "affected", "version": "<= 2.0.0"}]}], "references": [{"url": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2", "name": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/devtron-labs/devtron/commit/d2b0d260d858ab1354b73a8f50f7f078ca62706f", "name": "https://github.com/devtron-labs/devtron/commit/d2b0d260d858ab1354b73a8f50f7f078ca62706f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T21:37:04.483Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25538", "state": "PUBLISHED", "dateUpdated": "2026-02-05T18:37:58.750Z", "dateReserved": "2026-02-02T19:59:47.374Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T21:37:04.483Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "devtron", "vendor": "devtron-labs", "versions": [{"status": "affected", "version": "<= 2.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:devtron:devtron:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "4B1BB103-0C0A-4E78-A282-783DE037A037", "versionEndExcluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26."}, {"lang": "es", "value": "Devtron es una plataforma de integraci\u00f3n de herramientas de c\u00f3digo abierto para Kubernetes. En la versi\u00f3n 2.0.0 y anteriores, existe una vulnerabilidad en la interfaz de la API de Atributos de Devtron, que permite a cualquier usuario autenticado (incluidos los desarrolladores de CI/CD con bajos privilegios) obtener la clave de firma del Token de la API global accediendo al endpoint /orchestrator/attributes?key=apiTokenSecret. Despu\u00e9s de obtener la clave, los atacantes pueden falsificar tokens JWT para identidades de usuario arbitrarias sin conexi\u00f3n, obteniendo as\u00ed control total sobre la plataforma Devtron y movi\u00e9ndose lateralmente al cl\u00faster de Kubernetes subyacente. Este problema ha sido parcheado mediante el commit d2b0d26."}], "id": "CVE-2026-25538", "lastModified": "2026-06-17T10:24:49.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25538", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T18:37:54.919579Z", "version": "2.0.3"}}]}, "published": "2026-02-04T22:15:59.943", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/devtron-labs/devtron/commit/d2b0d260d858ab1354b73a8f50f7f078ca62706f"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:09:26.873083+00:00", "value": {"mitigation_remediation": ["Apply the official fix resulting from commit d2b0d260d858ab1354b73a8f50f7f078ca62706f or upgrade to a version newer than 2.0.0.", "Restrict the /orchestrator/attributes API endpoint to users with administrative privileges or disable the key retrieval parameter entirely.", "Rotate all API tokens and JWT signing keys throughout the Devtron deployment after applying the patch to eliminate any compromised keys."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation and Platform Compromise"}, "threat_synthesis": {"affected_systems": "The issue affects Devtron versions 2.0.0 and earlier deployed on Kubernetes environments. The affected product is the Devtron application platform, as listed by the CNA vendor devtron-labs. No additional product variants are implicated by the current data.", "description_and_impact": "The vulnerability in Devtron\u2019s Attributes API allows any authenticated user to retrieve the global API Token signing key via /orchestrator/attributes?key=apiTokenSecret. With the key attackers can forge JWTs for arbitrary identities offline, granting them full control over the Devtron platform and enabling lateral movement into the underlying Kubernetes cluster. This flaw is a classic example of insufficient authorization checks (CWE-862).", "risk_and_exploitability": "Overall severity is high with a CVSS score of 8.7, but the EPSS score is less than 1\u202f% and the vulnerability is not yet in the CISA KEV catalog, indicating a relatively low probability of exploitation in the wild. Exploitation requires only standard authentication to Devtron, so low\u2011privileged CI/CD developers can trigger the endpoint. Once the signing key is stolen, attackers can impersonate any user, creating a complete loss of confidentiality, integrity, and availability for the entire platform."}}}}, "created": "2026-02-05T11:39:23.632825+00:00", "updated": "2026-04-17T23:15:30.804907+00:00", "vendors": ["devtron", "devtron$PRODUCT$devtron"]}