CVE-2026-92720CWE-306

CVE-2026-92720

Critical · published September 16, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00632 · 49.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-16T22:17Z
References (5)
https://github.com/kubero-dev/kubero · [email protected]https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/main.ts · [email protected]https://github.com/kubero-dev/kubero/blob/v3.1.1/server/src/notifications/notifications.controller.ts#L23-L33 · [email protected]https://github.com/kubero-dev/kubero/issues/753 · [email protected]https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifications-api-access · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 17:31Z
    Kubero through 3.1.1 Unauthenticated Notifications API Access
    cvelistv5