{"id":"CVE-2026-107589","published":"2026-10-08T15:17:45.153","lastModified":"2026-10-08T21:02:43.860","description":"Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://ecp-ci.gitlab.io/docs/releasenotes/jacamar/jacamar_0.30.0.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows authenticated CI users to create arbitrary service account names, potentially leading to credential exposure or privilege escalation through insufficient validation of job configurations. This represents a significant risk in CI/CD environments where service accounts are used for automation.","exploitability":"Exploitation requires an authenticated CI user with access to job creation functionality, making it moderately difficult to achieve but not highly complex.","blast_radius":"If exploited, this vulnerability could allow attackers to create service accounts with elevated privileges or access to sensitive systems, potentially compromising the entire CI/CD pipeline and associated infrastructure.","remediation":"Upgrade to Jacamar CI v0.30.0 or later to address the insufficient job validation for service accounts.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ci-cd","auth-bypass","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:25:48.340Z"}}