Vulnerability record/PUBLISHED/Published Nov 9, 2026 23:27:41 UTC

CVE-2026-125370

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

Base score9.3/ 10

SeverityCriticalCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityCritical

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionNoneUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityHighVI

Vulnerable system availabilityHighVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck

Last updatedNov 11, 2026 11:53:11 UTC

PublishedNov 9, 2026 23:27:41 UTC

ReservedNov 9, 2026 22:03:03 UTC

Credits

Azizbek Tursunov (28Hus)