Kubero EUVD-2026-80903

Exploitation requires network reachability to a Kubero instance (version ≤3.1.1) whose notifications API endpoints are exposed; because these endpoints lack authentication guards (CWE-306), no credentials, user interaction, or special privileges are needed once the API is reachable. The primary limiting factor is exposure: instances whose management API/dashboard is bound only to a trusted internal network or protected by an upstream authenticating reverse proxy are not exploitable by external unauthenticated attackers. No non-default feature toggle is required - the flaw is in the default routing/guard configuration of the notifications controller.

The vendor CVSS 4.0 base score of 9.3 is driven by a clean AV:N/AC:L/AT:N/PR:N/UI:N vector paired with VC:H/VI:H, which is internally consistent with CWE-306 (Missing Authentication for a Critical Function): the notifications API endpoints are reachable over the network with no authentication and expose stored secrets (confidentiality) while also permitting attackers to register or delete webhook configurations (integrity). The technical claim is credible and traceable to the linked source at notifications.controller.ts#L23-L33 and main.ts. However, the real-world risk is tempered by exposure and prevalence rather than by exploit difficulty: Kubero is a self-hosted, open-source Kubernetes PaaS, so exploitation depends on the management API being network-reachable to the attacker. No EPSS score is provided, this CVE is not in CISA KEV, and no explicit proof-of-concept is published in the references (a VulnCheck advisory and the GitHub issue exist but no weaponized exploit is confirmed) - so exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict; this is a genuinely serious authorization flaw whose aggregate priority is bounded mainly by the product's limited deployment footprint and by whether the Kubero dashboard/API is exposed beyond a trusted network. VI:H is slightly generous - impact is scoped to notification/webhook configuration tampering and secret theft rather than full application compromise.

An attacker who can reach a Kubero instance's API (v3.1.1 or earlier) sends unauthenticated HTTP requests directly to the notifications endpoints, reading back stored webhook secrets and service URLs. Using the leaked secrets and the unauthenticated write access, the attacker registers a malicious webhook to intercept CI/CD pipeline events or deletes existing notification configs to suppress alerting during a follow-on attack. No public exploit code is identified at time of analysis, but the flaw requires only ordinary HTTP requests given AV:N/AC:L/PR:N.