{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kubero-3.0.0-through-3.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kubero:kubero:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-125370"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kubero (3.0.0 through 3.1.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Kubero"],"content_html":"\u003cp\u003eKubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability. When JWT_SECRET is unset, the application uses a hardcoded fallback signing secret. This allows unauthenticated remote attackers to forge administrative JWTs with arbitrary role, userGroups, and permissions claims. The JwtStrategy.validate() method trusts these forged tokens without performing a database lookup, allowing attackers to take control of pipelines, applications, users, and API tokens.\u003c/p\u003e\n","date_modified":"2026-11-10T02:00:29Z","date_published":"2026-11-10T02:00:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kubero-auth-bypass/","summary":"Kubero versions 3.0.0 through 3.1.1 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset.","title":"Kubero: Authentication bypass via hardcoded JWT secret (CVE-2026-125370)","url":"https://feed.craftedsignal.io/briefs/2026-11-kubero-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Kubero (3.0.0 Through 3.1.1)","version":"https://jsonfeed.org/version/1.1"}