Skip to content
OpenAdvisories

Product · devtron-labs

devtron

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-82882

    Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

    Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project,…

    devtron-labs devtron
  • High 8.7
    CVE-2026-25538

    Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage

    Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API …

    devtron-labs devtron github.com/devtron-labs/devtron Go
  • High 8.3
    CVE-2024-45794

    SQL Injection in CreateUser API in devtron

    devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/…

    devtron-labs devtron github.com/devtron-labs/devtron Go