Vulnerability · Published Oct 8, 2026 · Assigned by GitLab
CVE-2026-107589Authentication Bypass by Spoofing in Jacamar CI
High 7.5
In plain English
A high-severity authentication bypass by spoofing in Jacamar CI from Jacamar CI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.1%top 98.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jacamar CI | Jacamar CI | 0 – before 0.30.0 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L