CVE-2026-125370: Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWTSECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Kubero versions 3.0.0 through 3.1.1 are affected when JWT_SECRET is unset, causing the application to use a hardcoded fallback signing secret.
What does an attacker need to exploit this issue?
An attacker can exploit it remotely without authentication or user interaction by forging a JWT using the hardcoded fallback secret. The forged token can contain arbitrary role, userGroups, and permissions claims.
How can I determine whether my deployment is at risk?
Check whether the Kubero deployment is running a version from 3.0.0 through 3.1.1 and whether JWT_SECRET is unset. Deployments meeting both conditions are exposed to forged administrative tokens.
What can be done if updating is not immediately possible?
Set JWT_SECRET so Kubero does not use the hardcoded fallback signing secret. Because token claims are trusted without a database lookup, treat existing or suspected forged tokens as potentially administrative.