CVE-2026-125370

Summary

Kubero versions 3.0.0 through 3.1.1 contain an authentication bypass due to use of a hardcoded JWT signing secret when JWT_SECRET is not configured, allowing unauthenticated attackers to forge valid admin-level tokens. The JwtStrategy.validate() method trusts token claims without database verification, enabling full administrative control over pipelines, applications, users, and API tokens.

Exploitability

Exploitation is trivial for remote attackers with network access; no authentication or user interaction is required, and only knowledge of the JWT structure is needed to forge tokens.

Blast radius

Successful exploitation grants full administrative control of the Kubero instance, enabling complete compromise of CI/CD workflows, data exfiltration, service disruption, and lateral movement via stolen API tokens.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Kubero 3.1.2 or later, which removes the hardcoded fallback secret and enforces a valid JWT_SECRET configuration before accepting tokens.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.