CVE-2026-92720criticalCWE-306

Kubero through 3.1.1 Unauthenticated Notifications API Access

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.5%

probabilidad de explotación

0.5%top 60% de las CVE

explotación observada

noninguna fuente lo reporta

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Productos afectados

kubero-dev · kubero

Referencias

https://github.com/kubero-dev/kubero https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifications.controller.ts#L23-L33 https://github.com/kubero-dev/kubero/issues/753 https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifications-api-access