CVE-2026-125370

Name of the Vulnerable Software and Affected Versions Kubero versions 3.0.0 through 3.1.1

Description An authentication bypass exists that allows unauthenticated remote attackers to forge administrative JSON Web Tokens (JWTs) when the JWT SECRET variable is unset. This occurs because the system uses a hardcoded fallback signing secret. Attackers can sign tokens with arbitrary role, userGroups, and permissions claims, which the JwtStrategy.validate() function trusts without performing a database lookup. This can lead to full administrative control over pipelines, applications, users, and API tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.