CVE-2026-92720: Kubero Authentication Bypass Vulnerability

CVE-2026-92720 Overview

CVE-2026-92720 is a missing authentication vulnerability [CWE-306] in Kubero through version 3.1.1. The Kubero platform fails to apply authentication guards to its notifications API endpoints. Unauthenticated attackers can read webhook secrets and service URLs directly from the API. Attackers can also register malicious webhooks to intercept pipeline events or delete existing configurations to suppress alerting.

Kubero is a self-hosted Platform-as-a-Service (PaaS) that runs on Kubernetes and manages application deployments. Exposure of webhook secrets enables downstream attacks against connected notification services such as Slack, Microsoft Teams, and custom webhook consumers.

Critical Impact
Remote, unauthenticated attackers can exfiltrate webhook credentials, hijack pipeline event streams, and delete notification configurations across any internet-reachable Kubero deployment.

Affected Products

Kubero versions up to and including 3.1.1
Kubero self-hosted deployments exposing the server component
Kubernetes environments running the vulnerable notifications.controller.ts endpoints

Discovery Timeline

2026-09-16 - CVE-2026-92720 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92720

Vulnerability Analysis

The Kubero server exposes REST endpoints under the notifications controller for managing webhook integrations. These endpoints allow reading, creating, updating, and deleting notification configurations that include destination URLs and shared secrets. In the affected releases, no authentication guard is applied to these routes at the framework level or within the controller itself.

An attacker who can reach the Kubero API over the network can enumerate all configured notifications by issuing a simple HTTP GET request. Responses include the webhook secret used to sign or authenticate outbound requests to third-party systems. Attackers can then forge signed messages, register attacker-controlled webhook destinations, or delete existing entries to blind operators to security events.

The flaw affects the confidentiality and integrity of pipeline telemetry and any downstream systems that trust the leaked secrets.

Root Cause

The root cause is missing authentication [CWE-306] on the notifications controller routes defined in server/src/notifications/notifications.controller.ts. The application bootstrap in server/src/main.ts does not enforce a global authentication guard covering these handlers, and no per-route decorator restricts access. As a result, the endpoints are reachable by any unauthenticated client that can connect to the Kubero server.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker locates an internet-exposed Kubero instance, then issues HTTP requests to the unauthenticated notifications endpoints. The attacker reads existing webhook secrets, submits new notification entries pointing to attacker infrastructure, or deletes legitimate entries to suppress alerts. See the VulnCheck Advisory: Kubero 3.1.1 and the GitHub Notifications Controller Code for endpoint details.

Detection Methods for CVE-2026-92720

Indicators of Compromise

Unauthenticated HTTP requests to the Kubero /notifications API paths in server or reverse-proxy access logs.
Notification entries containing destination URLs pointing to unknown or attacker-controlled domains.
Unexpected deletion or modification of existing notification configurations without a corresponding administrator session.
Outbound webhook traffic from Kubero to hosts outside the approved integration list.

Detection Strategies

Audit the notifications table or configuration store for entries whose destination URL or secret was recently changed.
Compare current notification configurations against a known-good baseline captured before upgrading or applying the patch.
Correlate reverse-proxy access logs with authenticated session activity to identify API access without a valid session cookie or token.

Monitoring Recommendations

Ingest Kubero server logs, ingress controller logs, and Kubernetes audit logs into a centralized analytics platform for correlation.
Alert on any HTTP 2xx response from /api/notifications routes when the request lacks an authenticated session identifier.
Monitor egress traffic from Kubero pods for connections to newly observed webhook destinations.

How to Mitigate CVE-2026-92720

Immediate Actions Required

Restrict network access to the Kubero API using Kubernetes NetworkPolicies, an ingress allowlist, or a VPN until a patched release is deployed.
Rotate all webhook secrets and reissue signing keys for every notification integration configured in Kubero.
Review and remove any notification entries whose destination URLs cannot be attributed to a known integration.
Track fix availability in GitHub Issue #753 and the Kubero repository.

Patch Information

At the time of publication, the advisory identifies Kubero through 3.1.1 as vulnerable. Upgrade to a Kubero release later than 3.1.1 that adds authentication guards to the notifications controller once one is published by the maintainers. Refer to the VulnCheck Advisory: Kubero 3.1.1 for the current fix status.

Workarounds

Place the Kubero server behind an authenticating reverse proxy that requires a valid session or mutual TLS certificate before forwarding requests to /notifications paths.
Apply Kubernetes NetworkPolicy rules that restrict ingress to the Kubero pod to trusted administrator source ranges only.
Temporarily remove sensitive webhook integrations from Kubero and manage notifications from an external orchestration layer until a patched release is available.

bash

# Example NetworkPolicy restricting ingress to the Kubero server pod
# Apply with: kubectl apply -f kubero-restrict.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: kubero-restrict-ingress
  namespace: kubero
spec:
  podSelector:
    matchLabels:
      app: kubero
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: admin-tools
      ports:
        - protocol: TCP
          port: 2000