CVE-2026-92720

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92720
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92720.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92720
Published
2026-09-16T17:31:40Z
Modified
2026-09-25T03:30:38Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Kubero through 3.1.1 Unauthenticated Notifications API Access
Details

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92720.json"
}
References

Affected packages

Git / github.com/kubero-dev/kubero

Affected ranges

Type
GIT
Repo
https://github.com/kubero-dev/kubero
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bcb52376b19347b8c36bc445ddf3e4bff4a5c168
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "3.1.1"
        },
        {
            "fixed":  "3.1.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.10.0
v1.10.0-beta
v1.10.0-beta.1
v1.10.0-beta.2
v1.10.1
v1.10.2
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.11.5
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.6.1
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v1.9.9
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.4.0
v2.4.1
v2.4.3
v2.4.4
v2.4.4-rc.1
v2.4.5
v2.4.6
v2.4.7
v3.*
v3.0.0
v3.0.1
v3.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92720.json"