Kubero-dev vulnerabilities
We track 2 vulnerabilities in Kubero-dev products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
2vulnerabilities
2critical
0high
0exploited
9.4average CVSS score
Latest Kubero-dev vulnerabilities
- 9.8 Critical severity
kubero: Use of Hard-coded Cryptographic Key
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary
- 9.1 Critical severity
kubero: Missing Authentication for Critical Functionality
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pi