CVE-2026-92720

critical

Description

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

References

https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifications-api-access

https://github.com/kubero-dev/kubero/issues/753

https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifications.controller.ts#L23-L33

https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts

https://github.com/kubero-dev/kubero

Details

Source: Mitre, NVD

Published: 2026-09-16

Updated: 2026-09-17

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.00469