CVE-2026-125370 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kubero 3.0.0 through 3.1.1 falls back to a hardcoded signing secret when JWT_SECRET is unset, so anyone can forge administrative JSON Web Tokens. A forged token lets an unauthenticated remote attacker take control of pipelines, applications, users and API tokens.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Kubero 3.0.0 through 3.1.1 where the JWT_SECRET environment variable is not set. The flaw is in the JWT validation path, which trusts role and permission claims without a database lookup, so any network-reachable Kubero instance on the fallback secret is exposed. Instances that set JWT_SECRET to a strong value are not affected by the hardcoded secret.
Not affected if jwt-secret-set, unaffected-version
Who cares kubernetes, kubero, self-hosted
JWT_SECRET environment variable is set on the Kubero deployment; if it is unset, the hardcoded fallback is in use.3.0.0 through 3.1.1 are affected.Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.