CVE-2026-82882: Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user with an authenticated Devtron account can exploit it. The attacker does not need elevated privileges and can supply arbitrary project, environment, and application parameters to the affected endpoint.
What access can an attacker obtain?
The endpoint can return plaintext super-admin JWT tokens. A retrieved token gives the attacker full control of the Devtron platform.
How can defenders determine whether exploitation may have occurred?
Review requests to GET /orchestrator/api-token/webhook, particularly requests from low-privileged accounts or requests using unexpected project, environment, or application parameters. Because the returned tokens are super-admin JWTs, treat suspicious access to this endpoint as potential platform-level compromise.