CVE-2026-82882

Name of the Vulnerable Software and Affected Versions Devtron versions prior to 2.2.1

Description Insufficient authorization checks on the 'GET /orchestrator/api-token/webhook' endpoint allow authenticated users to retrieve admin API tokens. By providing arbitrary project, environment, and application parameters, an attacker with any valid account can obtain plaintext super-admin JWT (JSON Web Token) tokens, which are used for authentication and authorization, granting full control over the platform.

Recommendations Update to a version newer than 2.2.0. Restrict access to the 'GET /orchestrator/api-token/webhook' endpoint to minimize the risk of exploitation.