EUVD-2026-80903
GHSA-m69f-42c6-7334
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access to endpoints lacking auth (PR:N/AV:N/AC:L); C:H for leaked webhook secrets, I:L for scoped webhook-config tampering, A:N as service stays up.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
AnalysisAI
Unauthenticated access to the Kubero notifications API endpoints in versions through 3.1.1 allows remote attackers to read stored webhook secrets and service URLs and to create or delete webhook configurations, because those endpoints lack authentication guards (CWE-306). The independent CVSS 3.1 assessment rates this as network-exploitable with no privileges or user interaction required, high confidentiality impact from secret exposure, low integrity impact from webhook manipulation, and no availability impact; the primary limiting factor is network exposure, as instances whose API is bound only to trusted internal networks or protected by an upstream authenticating reverse proxy are not exploitable by external unauthenticated attackers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to a Kubero instance (version ≤3.1.1) whose notifications API endpoints are exposed; because these endpoints lack authentication guards (CWE-306), no credentials, user interaction, or special privileges are needed once the API is reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 base score of 9.3 is driven by a clean AV:N/AC:L/AT:N/PR:N/UI:N vector paired with VC:H/VI:H, which is internally consistent with CWE-306 (Missing Authentication for a Critical Function): the notifications API endpoints are reachable over the network with no authentication and expose stored secrets (confidentiality) while also permitting attackers to register or delete webhook configurations (integrity). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the provided intelligence at time of analysis; monitor the upstream issue at https://github.com/kubero-dev/kubero/issues/753 and the VulnCheck advisory at https://www.vulncheck.com/advisories/kubero-through-3.1.1-unauthenticated-notifications-api-access for a fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today