Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92720Kubero through 3.1.1 Unauthenticated Notifications API Access
Critical 9.1
In plain English
A critical-severity missing authentication in kubero from kubero-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.6%top 49.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kubero-dev | kubero | 0 – through 3.1.1 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Issue #753 issue-tracking
- https://github.com/kubero-dev/kubero product
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifications.controller.ts#L23-L33 technical-description
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts technical-description
- VulnCheck Advisory: Kubero through 3.1.1 Unauthenticated Notifications API Access third-party-advisory