Devtron
Monthly
Missing authorization on Devtron's webhook API token endpoint allows any authenticated user - regardless of privilege level - to retrieve plaintext super-admin JWT tokens, yielding full platform control. The GET /orchestrator/api-token/webhook endpoint in versions through 2.2.0 performs no authorization check beyond validating that a session exists, meaning a low-privilege operator account is sufficient to extract credentials that grant unrestricted administrative access. No patch version has been confirmed in the available references, and no public exploit or CISA KEV listing has been identified at time of analysis.
Devtron is an open source tool integration platform for Kubernetes. [CVSS 8.8 HIGH]
devtron is an open source tool integration platform for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization on Devtron's webhook API token endpoint allows any authenticated user - regardless of privilege level - to retrieve plaintext super-admin JWT tokens, yielding full platform control. The GET /orchestrator/api-token/webhook endpoint in versions through 2.2.0 performs no authorization check beyond validating that a session exists, meaning a low-privilege operator account is sufficient to extract credentials that grant unrestricted administrative access. No patch version has been confirmed in the available references, and no public exploit or CISA KEV listing has been identified at time of analysis.
Devtron is an open source tool integration platform for Kubernetes. [CVSS 8.8 HIGH]
devtron is an open source tool integration platform for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.