Vulnerability Description
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/kubero-dev/kubero
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifi
- https://github.com/kubero-dev/kubero/issues/753
- https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifi
FAQ
What is CVE-2026-92720?
CVE-2026-92720 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored...
How severe is CVE-2026-92720?
CVE-2026-92720 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-92720?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.