← Back to CVE List
CVE-2026-92720NVD
Vulnerability Summary
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
External References
- https://github.com/kubero-dev/kubero/issues/753
- https://github.com/kubero-dev/kubero
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifications.controller.ts#L23-L33
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts
- https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifications-api-access