{"id":"CVE-2026-115830","kind":"vulnerability","aliases":["CVE-2026-115830"],"related":[],"title":"Secret Server: unsigned JWT grants cloud admin permissions under certain conditions","description":"In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.","summary":"Secret Server versions earlier than 12.3.1 accept an unsigned JWT under certain conditions. A user who submits one receives cloudadmin permissions in response.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","secret-server","self-hosted"],"not_affected_if":["version-12.3.1-or-later"],"how_to_check":"- Check the installed Secret Server version against `12.3.1`.","fix":"- Secret Server: move to `12.3.1` or later.","status":"open","published_at":"2026-10-30T20:17:02+00:00","first_seen_at":"2026-10-30T20:25:37+00:00","triaged_at":"2026-10-30T20:26:18+00:00","updated_at":"2026-10-30T20:26:18+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T20:26:18Z","model":"claude-haiku-5-5","output":{"fix":"- Secret Server: move to `12.3.1` or later.","reach":"network","title":"Secret Server: unsigned JWT grants cloud admin permissions under certain conditions","impact":"high","summary":"Secret Server versions earlier than 12.3.1 accept an unsigned JWT under certain conditions. A user who submits one receives cloudadmin permissions in response.","audience":"businesses","category":"other","nicknames":[],"who_cares":["secret-server","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains cloud admin permissions on the Secret Server instance","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115830 and vendor notes for the specific conditions required and any mitigations.","how_to_check":"- Check the installed Secret Server version against `12.3.1`.\n- unknown for other checks; the sources do not say which conditions are required.","plain_action":"","needs_analyst":true,"not_affected_if":["version-12.3.1-or-later"],"who_is_affected":"Organizations running Secret Server earlier than 12.3.1. The sources say exploitation requires certain conditions but do not state which ones, so exposure beyond the version check is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":4080,"output_tokens":493,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115830':14A,17A '-2026':13A,16A '12.3.1':30B,54C 'accept':31B 'admin':7A 'certain':10A,36B,58C 'cloud':6A 'cloudadmin':44B,67C 'condit':11A,37B,59C 'could':60C 'cve':12A,15A 'earlier':28B,52C 'grant':5A 'host':24B 'jwt':4A,34B,64C 'one':42B 'permiss':8A,45B,68C 'receiv':43B,66C 'respons':47B,70C 'secret':1A,20B,25B,49C 'secret-serv':19B 'self':23B 'self-host':22B 'server':2A,21B,26B,50C 'submit':41B,61C 'unsign':3A,33B,63C 'user':39B,56C 'version':27B,51C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Secret Server earlier than 12.3.1. The sources say exploitation requires certain conditions but do not state which ones, so exposure beyond the version check is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"1443cd92-d354-46d2-9290-d812316ca43a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115830","severity":null,"published_at":"2026-10-30T20:17:02+00:00","modified_at":"2026-10-30T20:17:02+00:00","first_seen_at":"2026-10-30T20:25:37+00:00","fetched_at":"2026-10-30T20:25:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}