Authentication Bypass Vulnerability in Kubero by Kubero Dev

CVE-2026-125370

What is CVE-2026-125370?

Kubero versions 3.0.0 to 3.1.1 are susceptible to an authentication bypass issue, enabling unauthenticated remote attackers to forge administrative JSON Web Tokens (JWTs). This occurs due to the use of a hardcoded fallback signing secret in cases where the JWT_SECRET is unset. Attackers can exploit this vulnerability to create tokens that include arbitrary roles, user groups, and permissions, allowing them to gain control over pipelines, applications, users, and API tokens, as the JwtStrategy.validate() function trusts these signed tokens without conducting a database lookup. This oversight can potentially lead to severe consequences for affected systems.

References