Devtron-labs vulnerabilities
We track 3 vulnerabilities in Devtron-labs products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 31, 2026.
Latest Devtron-labs vulnerabilities
- 8.8 High severity
devtron: Missing Authorization
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project,
- 8.8 High severity
devtron: Missing Authorization
Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API T
- 8.8 High severity
devtron: Improper Neutralization of Special Elements used in an SQL Command
devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/u