kubero-dev kubero vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 9.3CVE-2026-125370EPSS 0.7%2026-11-10

   Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign …

2. 9.3CVE-2026-92720EPSS 0.6%2026-09-16

   Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious web…