{"id":"CVE-2026-125370","kind":"vulnerability","aliases":["CVE-2026-125370"],"related":[],"title":"Kubero: hardcoded fallback JWT secret lets attackers forge admin tokens","description":"Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.","summary":"Kubero 3.0.0 through 3.1.1 falls back to a hardcoded signing secret when JWT_SECRET is unset, so anyone can forge administrative JSON Web Tokens. A forged token lets an unauthenticated remote attacker take control of pipelines, applications, users and API tokens.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","kubero","self-hosted"],"not_affected_if":["jwt-secret-set","unaffected-version"],"how_to_check":"- Check whether the `JWT_SECRET` environment variable is set on the Kubero deployment; if it is unset, the hardcoded fallback is in use.\n- Check the installed Kubero version; versions `3.0.0` through `3.1.1` are affected.","fix":"- Kubero: the sources do not state a fixed version.","status":"open","published_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:29:42+00:00","updated_at":"2026-11-10T00:29:42+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T00:29:42Z","model":"claude-haiku-5-5","output":{"fix":"- Kubero: the sources do not state a fixed version.","reach":"internet","title":"Kubero: hardcoded fallback JWT secret lets attackers forge admin tokens","impact":"high","summary":"Kubero 3.0.0 through 3.1.1 falls back to a hardcoded signing secret when JWT_SECRET is unset, so anyone can forge administrative JSON Web Tokens. A forged token lets an unauthenticated remote attacker take control of pipelines, applications, users and API tokens.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubero","self-hosted","kubernetes"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker gains admin control over pipelines, apps and secrets","analyst_note":"Confirm the fixed version and whether the vendor advisory (www.vulncheck.com) names a patch or setting; the sources do not state one.","how_to_check":"- Check whether the `JWT_SECRET` environment variable is set on the Kubero deployment; if it is unset, the hardcoded fallback is in use.\n- Check the installed Kubero version; versions `3.0.0` through `3.1.1` are affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["jwt-secret-set","unaffected-version"],"who_is_affected":"Teams that run Kubero 3.0.0 through 3.1.1 where the JWT_SECRET environment variable is not set. The flaw is in the JWT validation path, which trusts role and permission claims without a database lookup, so any network-reachable Kubero instance on the fallback secret is exposed. Instances that set JWT_SECRET to a strong value are not affected by the hardcoded secret.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000792,"input_tokens":4637,"output_tokens":656,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125370':13A,16A '-2026':12A,15A '3.0.0':24B,65C '3.1.1':26B,67C 'admin':9A 'administr':43B,80C 'allow':74C 'anyon':40B 'api':62B,120C 'applic':59B,117C 'arbitrari':99C 'attack':7A,54B,77C,94C 'authent':70C 'back':28B 'bypass':71C 'claim':104C 'contain':68C 'control':56B,114C 'cve':11A,14A 'databas':110C 'fall':27B 'fallback':3A,86C 'forg':8A,42B,48B,79C 'hardcod':2A,31B,85C 'host':22B 'infrastructur':17B 'json':44B 'jwt':4A,35B,90C 'jwts':81C 'jwtstrategy.validate':106C 'kubernet':18B 'kubero':1A,19B,23B,64C 'let':6A,50B 'lookup':111C 'permiss':103C 'pipelin':58B,116C 'remot':53B,76C 'role':100C 'secret':5A,33B,36B,88C,91C 'self':21B 'self-host':20B 'sign':32B,87C,96C 'take':55B,113C 'token':10A,46B,49B,63B,97C,121C 'trust':107C 'unauthent':52B,75C 'unset':38B,93C 'use':83C 'user':60B,118C 'usergroup':101C 'vulner':72C 'web':45B 'without':108C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Kubero 3.0.0 through 3.1.1 where the JWT_SECRET environment variable is not set. The flaw is in the JWT validation path, which trusts role and permission claims without a database lookup, so any network-reachable Kubero instance on the fallback secret is exposed. Instances that set JWT_SECRET to a strong value are not affected by the hardcoded secret.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","kubernetes","kubero","selfhosted"],"campaign_type":null,"search_a":"'-125370':13A,16A '-2026':12A,15A 'admin':9A 'attack':7A 'cve':11A,14A 'fallback':3A 'forg':8A 'hardcod':2A 'jwt':4A 'kubero':1A 'let':6A 'secret':5A 'token':10A","search_b":"'3.0.0':24B '3.1.1':26B 'administr':43B 'anyon':40B 'api':62B 'applic':59B 'attack':54B 'back':28B 'control':56B 'fall':27B 'forg':42B,48B 'hardcod':31B 'host':22B 'infrastructur':17B 'json':44B 'jwt':35B 'kubernet':18B 'kubero':19B,23B 'let':50B 'pipelin':58B 'remot':53B 'secret':33B,36B 'self':21B 'self-host':20B 'sign':32B 'take':55B 'token':46B,49B,63B 'unauthent':52B 'unset':38B 'user':60B 'web':45B","search_c":"'3.0.0':65C '3.1.1':67C 'administr':80C 'allow':74C 'api':120C 'applic':117C 'arbitrari':99C 'attack':77C,94C 'authent':70C 'bypass':71C 'claim':104C 'contain':68C 'control':114C 'databas':110C 'fallback':86C 'forg':79C 'hardcod':85C 'jwt':90C 'jwts':81C 'jwtstrategy.validate':106C 'kubero':64C 'lookup':111C 'permiss':103C 'pipelin':116C 'remot':76C 'role':100C 'secret':88C,91C 'sign':87C,96C 'take':113C 'token':97C,121C 'trust':107C 'unauthent':75C 'unset':93C 'use':83C 'user':118C 'usergroup':101C 'vulner':72C 'without':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125370","severity":null,"published_at":"2026-11-10T00:17:09+00:00","modified_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111518,"url":"https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}