{"id":"CVE-2026-125370","aliases":[],"cve":{"records":[{"id":"CVE-2026-125370","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-09T22:03:03.950Z","published":"2026-11-09T23:27:41.949Z","modified":"2026-11-13T13:52:37.225Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-11T11:53:11.145Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T13:52:37.225Z"}],"references":[{"url":"https://github.com/kubero-dev/kubero/issues/786","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/kubero-dev/kubero","tags":["product"],"source":"VulnCheck"},{"url":"https://github.com/kubero-dev/kubero/blob/bcb52376b19347b8c36bc445ddf3e4bff4a5c168/server/src/auth/strategies/jwt.strategy.ts#L13-L32","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/kubero-dev/kubero/issues/786","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-321","description":"Use of Hard-coded Cryptographic Key","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T13:51:49.417374Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.","score":9.8,"severity":"critical","published":"2026-11-09T23:27:41.949Z","modified":"2026-11-13T13:52:37.225Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"kubero-dev","name":"kubero","platforms":[],"versions":[{"version":"3.0.0","status":"affected","lessThanOrEqual":"3.1.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-125370"}],"remediation":[],"references":["https://github.com/kubero-dev/kubero/issues/786","https://github.com/kubero-dev/kubero","https://github.com/kubero-dev/kubero/blob/bcb52376b19347b8c36bc445ddf3e4bff4a5c168/server/src/auth/strategies/jwt.strategy.ts#L13-L32","https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret"],"sources":[{"name":"CVE","id":"CVE-2026-125370","modified":"2026-11-13T13:52:37.225Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-125370"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-13T18:01:05.544Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:00:33.590Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-10T00:35:34.767Z","attemptedAt":"2026-11-10T00:35:34.767Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-10T00:35:35.439Z","attemptedAt":"2026-11-10T00:35:35.439Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-10T00:35:35.674Z","attemptedAt":"2026-11-10T00:35:35.674Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T00:35:34.830Z","attemptedAt":"2026-11-10T00:35:34.830Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-125370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125370","modified":"2026-11-10T00:17:09.370","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-10T00:35:34.767Z"},{"source":"NVD","id":"CVE-2026-125370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125370","modified":"2026-11-10T00:17:09.370","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-10T00:35:34.767Z"},{"source":"GitHub Advisory Database","id":"GHSA-42fc-m93g-j65w","url":"https://github.com/advisories/GHSA-42fc-m93g-j65w","modified":"2026-11-10T00:31:45Z","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-10T00:35:35.439Z"},{"source":"ENISA EUVD","id":"EUVD-2026-120533","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120533","modified":"Nov 9, 2026, 11:27:41 PM","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-10T00:35:35.674Z"}],"aiSummary":{"text":"Kubero versions 3.0.0 through 3.1.1 have an authentication bypass vulnerability due to a hardcoded JWT secret, allowing unauthenticated remote attackers to forge administrative JWTs. The weakness is caused by the use of a hardcoded cryptographic key. This may allow attackers to take control of various resources.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T23:56:16.060Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-125370"}]}}