Kubero: Authentication bypass via hardcoded JWT secret (CVE-2026-125370)
Kubero versions 3.0.0 through 3.1.1 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset.
CVE search metadata
CVE search record: CVE-2026-125370. Severity: critical. CVSS: 9.8. KEV: no. Product: Kubero (3.0.0 through 3.1.1). Brief: Kubero: Authentication bypass via hardcoded JWT secret (CVE-2026-125370). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kubero-auth-bypass/
Triage facts
Revision 1- Applicability
- Kubero (3.0.0 through 3.1.1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 02:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability. When JWT_SECRET is unset, the application uses a hardcoded fallback signing secret. This allows unauthenticated remote attackers to forge administrative JWTs with arbitrary role, userGroups, and permissions claims. The JwtStrategy.validate() method trusts these forged tokens without performing a database lookup, allowing attackers to take control of pipelines, applications, users, and API tokens.