CVE-2026-92720: Kubero through 3.1.1 Unauthenticated Notifications API Access
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kuberoto a version that resolves this vulnerability.Fixed in 3.1.1 - Compensating control
Restrict network access to the Kubero notifications API endpoints so unauthenticated users cannot reach them.
Event History
Frequently Asked Questions
Which deployments are exposed?
Kubero versions through 3.1.1 are affected. The issue is reachable over the network and requires no authentication or user interaction.
What can an unauthenticated attacker do?
An attacker can read webhook secrets and service URLs from the notifications API. They can also register malicious webhooks to receive pipeline events or delete existing notification configurations to suppress alerting.
How can I determine whether an instance has been affected?
Review notification configurations for unexpected webhook registrations, deletions, or changed service URLs. Treat stored webhook secrets as potentially exposed if the affected notifications API was network-accessible.