CVE-2026-107589: Authentication Bypass by Spoofing in Jacamar CI
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jacamar CIto a version that resolves this vulnerability.Fixed in v0.30.0 - Configuration
Restrict the allowed accounts or groups in the Jacamar CI configuration.
Jacamar CI allowed accounts or groups = restricted - Compensating control
Use the RunAs validation script to check for bot accounts.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Jacamar CI user can exploit it. The CVSS vector also indicates that user interaction is required and that the attack is performed over an adjacent network.
What is the impact of successful exploitation?
An attacker can generate arbitrary account names because service-account job validation is insufficient. The reported impact includes high confidentiality impact and low integrity and availability impact, with scope changed.
Which deployments are affected?
Jacamar CI versions prior to v0.30.0 are affected. The provided information does not state whether any particular configuration is affected by default.