{"id":"CVE-2026-125370","published":"2026-11-10T00:17:09.237","lastModified":"2026-11-10T00:17:09.370","description":"Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kubero-dev/kubero","tags":[]},{"url":"https://github.com/kubero-dev/kubero/blob/bcb52376b19347b8c36bc445ddf3e4bff4a5c168/server/src/auth/strategies/jwt.strategy.ts#L13-L32","tags":[]},{"url":"https://github.com/kubero-dev/kubero/issues/786","tags":[]},{"url":"https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret","tags":[]}],"exploitRefs":[{"url":"https://github.com/kubero-dev/kubero","tags":[]},{"url":"https://github.com/kubero-dev/kubero/blob/bcb52376b19347b8c36bc445ddf3e4bff4a5c168/server/src/auth/strategies/jwt.strategy.ts#L13-L32","tags":[]},{"url":"https://github.com/kubero-dev/kubero/issues/786","tags":[]}],"hasPoc":true,"ai":{"summary":"Kubero versions 3.0.0 through 3.1.1 contain an authentication bypass due to use of a hardcoded JWT signing secret when JWT_SECRET is not configured, allowing unauthenticated attackers to forge valid admin-level tokens. The JwtStrategy.validate() method trusts token claims without database verification, enabling full administrative control over pipelines, applications, users, and API tokens.","exploitability":"Exploitation is trivial for remote attackers with network access; no authentication or user interaction is required, and only knowledge of the JWT structure is needed to forge tokens.","blast_radius":"Successful exploitation grants full administrative control of the Kubero instance, enabling complete compromise of CI/CD workflows, data exfiltration, service disruption, and lateral movement via stolen API tokens.","remediation":"Upgrade to Kubero 3.1.2 or later, which removes the hardcoded fallback secret and enforces a valid JWT_SECRET configuration before accepting tokens.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","jwt-forgery","hardcoded-secret","kubernetes","ci-cd"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:44:48.740Z"}}