kubero vulnerabilities

2 known vulnerabilities in kubero from Kubero-dev. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  kubero: Use of Hard-coded Cryptographic Key

  CVE-2026-125370Nov 10, 2026Kubero-dev

  Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary

• 9.1 Critical severity

  kubero: Missing Authentication for Critical Functionality

  CVE-2026-92720Sep 16, 2026Kubero-dev

  Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pi