EUVD Vulnerability Catalog
EUVD-2026-80903
Severity: CRITICAL
Base Score: 9.3
CVSS Version: 4.0
Vulnerability Description
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): None
▪
User Interaction (UI): None
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): None
▪
Subsequent Confidentiality Impact (SC): None
▪
Subsequent Integrity Impact (SI): None
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
kubero-dev
References & Advisory Links
- https://github.com/kubero-dev/kubero/issues/753
- https://github.com/kubero-dev/kubero
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifications.controller.ts#L23-L33
- https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts
- https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifications-api-access
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
VulnCheck
EPSS Probability
0
Known Aliases
GHSA-m69f-42c6-7334
CVE-2026-92720
Published On
2026-09-16
Last Updated
2026-09-17