CVE-2026-92720

CVSS 9.3 (critical) · published 2026-09-16

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

Weakness: CWE-306

Source: NVD CVE-2026-92720

References

• https://github.com/kubero-dev/kubero
• https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts
• https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifications.controller.ts#L23-L33
• https://github.com/kubero-dev/kubero/issues/753
• https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifications-api-access

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.