Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M
CVE-2026-25538Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage
High 8.7
In plain English
A high-severity missing authorization in devtron from devtron-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/devtron-labs/devtron | no fix listed | GHSA-8wpc-j9q9-j5m2 |
| Go | github.com/devtron-labs/devtron | no fix listed | GO-2026-4416 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| devtron-labs | devtron | <= 2.0.0 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N