CVE-2026-42300

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42300
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42300.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42300
Aliases
Published
2026-05-12T17:25:20.435Z
Modified
2026-07-08T08:13:16.833059664Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header
Details

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources. This vulnerability is fixed in 1.2.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-288"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42300.json"
}
References

Affected packages

Git / github.com/l3montree-dev/devguard

Affected ranges

Type
GIT
Repo
https://github.com/l3montree-dev/devguard
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6f38310bf93b2a63df3055038f4da82b1f4e6d9a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.12.1
0.12.2
0.12.3
0.13.0
0.13.1
0.13.10
0.13.11
0.13.12
0.13.13
0.13.14
0.13.15
0.13.16
0.13.17
0.13.18
0.13.2
0.13.3
0.13.4
0.13.9
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.1
0.15.2
0.15.3
0.16.0
0.18.1
0.5.13
0.6.0
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.9.0
0.9.1
devguard-0.*
devguard-0.4.16
devguard-0.4.17
devguard-0.4.18
devguard-0.4.19
devguard-0.5.0
devguard-0.5.10
devguard-0.5.12
devguard-0.5.13
devguard-0.5.14
devguard-0.5.15
devguard-0.5.17
devguard-0.5.18
devguard-0.5.19
devguard-0.5.20
devguard-0.5.4
devguard-0.5.5
devguard-0.5.6
devguard-0.5.7
devguard-0.5.8
devguard-0.5.9
flawfix-0.*
flawfix-0.1.0
flawfix-0.2.0
flawfix-0.4.0
flawfix-0.4.1
flawfix-0.4.10
flawfix-0.4.11
flawfix-0.4.12
flawfix-0.4.13
flawfix-0.4.14
flawfix-0.4.15
flawfix-0.4.16
flawfix-0.4.4
flawfix-0.4.5
flawfix-0.4.6
flawfix-0.4.7
flawfix-0.4.8
flawfix-0.4.9
v0.*
v0.17.0
v0.17.1
v0.17.2
v0.17.3
v0.17.4
v0.17.5
v0.18.0
v0.18.1
v0.18.2
v0.18.3
v0.18.4
v0.18.5
v0.18.6
v0.18.7
v0.18.8
v0.18.9
v0.19.0
v0.19.1
v0.19.2
v0.2.0
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.18
v0.4.19
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.14
v1.*
v1.0.0
v1.0.0-rc.1
v1.0.0-rc.10
v1.0.0-rc.11
v1.0.0-rc.12
v1.0.0-rc.13
v1.0.0-rc.14
v1.0.0-rc.15
v1.0.0-rc.16
v1.0.0-rc.17
v1.0.0-rc.18
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.0-rc.8
v1.0.0-rc.9
v1.0.1
v1.1.0
v1.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42300.json"