Skip to content
OpenAdvisories

Vendor

kubero-dev

2 known vulnerabilities.

Products

kubero 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-125370

    Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret

    Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrar…

    kubero-dev kubero
  • Critical 9.1
    CVE-2026-92720

    Kubero through 3.1.1 Unauthenticated Notifications API Access

    Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept p…

    kubero-dev kubero