CVE-2026-107589CWE-290

CVE-2026-107589

High · published October 8, 2026

CVSS v3.1

7.5

EPSS

0%

Percentile

1.3

In the wild

Unconfirmed

What it is

Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00111 · 1.3th percentile
Weakness: CWE-290 · Authentication Bypass by Spoofing
Published: 2026-10-08T19:17Z

References (1)

https://ecp-ci.gitlab.io/docs/releasenotes/jacamar/jacamar_0.30.0.html · [email protected]

EPSS history

Timeline

10 OCT 03:27Z
EPSS moved — → 0%
epss
08 OCT 15:11Z
Authentication Bypass by Spoofing in Jacamar CI
cvelistv5
08 OCT 15:11Z
Authentication Bypass by Spoofing in Jacamar CI
cvelistv5