CVE-2026-82882: Devtron Authorization Bypass Vulnerability

CVE-2026-82882 Overview

CVE-2026-82882 is a missing authorization vulnerability [CWE-862] in Devtron through version 2.2.0. The GET /orchestrator/api-token/webhook endpoint fails to enforce authorization checks, allowing any authenticated user to retrieve administrative API tokens. Attackers can supply arbitrary project, environment, and application parameters to the endpoint and receive plaintext super-admin JSON Web Tokens (JWTs) in response. Recovered tokens grant full platform control, including the ability to deploy workloads, modify pipelines, and manipulate Kubernetes resources managed by Devtron.

Critical Impact
Any authenticated Devtron user can escalate to super-admin by retrieving plaintext admin JWTs from the unprotected webhook API token endpoint.

Affected Products

Devtron versions through 2.2.0
Devtron ApiTokenRestHandler component
Devtron ApiTokenService component

Discovery Timeline

2026-08-31 - CVE-2026-82882 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82882

Vulnerability Analysis

Devtron is an open-source Kubernetes application delivery platform that issues API tokens for automation and webhook integrations. The vulnerability resides in the webhook API token retrieval flow implemented in ApiTokenRestHandler.go and backed by ApiTokenService.go in the v2.2.0 codebase.

The handler for GET /orchestrator/api-token/webhook authenticates the caller but does not verify that the caller possesses the role-based access control (RBAC) permissions required to view tokens scoped to the requested project, environment, or application. As a result, any account with valid session credentials can invoke the endpoint and receive tokens minted for higher-privileged principals, including super-admin.

The returned tokens are plaintext JWTs signed by the Devtron server. An attacker who obtains one can present it as a bearer credential on subsequent API calls and inherit the full authority of the token owner.

Root Cause

The root cause is missing enforcement of authorization checks on a sensitive read endpoint. The handler validates authentication but omits the RBAC evaluation that other token management endpoints apply. This mismatch between authentication and authorization is the pattern described in CWE-862: Missing Authorization.

Attack Vector

The vulnerability is exploitable over the network by any authenticated principal, including low-privilege users such as developers restricted to a single application. The attacker issues a single HTTP GET request to /orchestrator/api-token/webhook with attacker-chosen projectId, environmentId, and appId query parameters. The response contains one or more plaintext admin JWTs, which the attacker replays against the Devtron API to take over the cluster deployment surface. See the VulnCheck Advisory for Devtron and GitHub Issue #7013 for further detail.

Detection Methods for CVE-2026-82882

Indicators of Compromise

Unexpected GET /orchestrator/api-token/webhook requests originating from user accounts that do not normally administer API tokens.
Successful Devtron API activity authenticated by JWTs that were not issued through documented token-creation workflows.
Deployment, pipeline, or cluster configuration changes performed by service or automation identities outside of change windows.

Detection Strategies

Audit Devtron access logs for any invocation of the /orchestrator/api-token/webhook endpoint and correlate the caller identity against expected administrators.
Alert on JWT usage where the sub or role claim indicates super-admin but the source IP or user agent differs from known administrative workstations.
Baseline API token issuance and usage patterns and flag deviations, particularly tokens replayed from new network origins shortly after webhook endpoint access.

Monitoring Recommendations

Forward Devtron orchestrator access logs and Kubernetes audit logs to a centralized analytics platform for retention and correlation.
Monitor Kubernetes API activity performed by Devtron service accounts for privilege escalation, secret access, and workload creation anomalies.
Track authentication events from Devtron's identity provider to correlate low-privilege logins with subsequent admin-scope API actions.

How to Mitigate CVE-2026-82882

Immediate Actions Required

Restrict network access to the Devtron orchestrator API so that only trusted operators and CI systems can reach /orchestrator/api-token/webhook.
Rotate all existing Devtron API tokens, especially super-admin tokens, and invalidate any JWTs that may have been exposed.
Review Devtron and Kubernetes audit logs for prior exploitation and revoke sessions tied to suspicious token usage.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry for CVE-2026-82882. Track upstream remediation through the GitHub Devtron Repository and GitHub Issue #7013, and apply the maintainer-supplied fix as soon as it is released. Source references for the affected code are available in ApiTokenRestHandler.go and ApiTokenService.go.

Workarounds

Place the Devtron dashboard and orchestrator API behind an authenticating reverse proxy that blocks non-admin users from reaching /orchestrator/api-token/webhook.
Tighten Devtron RBAC so the number of authenticated accounts able to reach the orchestrator API is minimized to trusted operators.
Reduce the blast radius of a compromised admin JWT by limiting the Kubernetes permissions granted to Devtron service accounts to the least privilege required.

bash

# Example: block the vulnerable endpoint at an ingress/reverse proxy until patched
# NGINX ingress annotation snippet
nginx.ingress.kubernetes.io/configuration-snippet: |
  location = /orchestrator/api-token/webhook {
    return 403;
  }