Devtron Authorization Bypass in Webhook API

Devtron versions 2.2.0 and earlier are affected by an authorization bypass vulnerability (CVE-2026-82882) located in the orchestrator webhook API. The vulnerability specifically affects the GET /orchestrator/api-token/webhook endpoint, which fails to validate the authorization level of the requesting user. An authenticated attacker, regardless of their original privilege level, can provide arbitrary project, environment, and application parameters to the endpoint to successfully query for and retrieve super-admin JSON Web Tokens (JWT) in plaintext. Successful exploitation provides the attacker with full platform control, enabling persistent access, configuration modifications, or unauthorized deployments within the Devtron environment. This vulnerability is critical for organizations using Devtron to manage CI/CD pipelines, as it allows for trivial privilege escalation to the highest administrative tier.

Impact

Successful exploitation of this vulnerability results in full administrative control over the Devtron platform. Attackers can leverage the stolen super-admin tokens to perform any action the platform supports, including modifying deployment pipelines, accessing sensitive secrets managed by the platform, and pivoting into the underlying Kubernetes infrastructure. This allows for extensive persistence, data exfiltration, and potential supply chain compromise of the integrated CI/CD processes.

Recommendation

1. Upgrade all Devtron instances to a version later than 2.2.0 immediately once a vendor patch is made available.
2. Implement strict monitoring on access to the /orchestrator/api-token/webhook endpoint in API gateway or web server logs.
3. Rotate all administrative tokens if it is suspected that an unauthorized user has accessed the platform.
4. Perform an audit of audit logs to identify any anomalous access to the webhook API endpoint by non-administrative user accounts.