CVE-2026-92720 | BDVDB-2026-375468 Detail
kubero-devkubero
Description#
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-306 Missing Authentication for Critical Function
References#
- https://github.com/kubero-dev/kubero/issues/753
- https://github.com/kubero-dev/kubero
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifications.controller.ts#L23-L33
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts
- https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifications-api-access
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.