CVE-2026-125370 is a critical authentication bypass in Kubero 3.0.0 through 3.1.1. When JWT_SECRET is unset, Kubero falls back to a hardcoded signing secret, so a remote attacker with no credentials can forge administrative JWTs.
What Is It
CVE-2026-125370 is an authentication bypass in Kubero, a project from kubero-dev. It is classified as CWE-321 (use of a hard-coded cryptographic key). If the JWT_SECRET environment variable is not set, Kubero signs tokens with a hardcoded fallback secret. An attacker who knows that secret can sign their own JWTs with any role, userGroups and permissions claims they choose.
According to the disclosure, JwtStrategy.validate() trusts those claims without checking them against the database. A forged token is therefore accepted as a real administrative session.
VulnCheck disclosed the issue. NVD has published a record for it, and the record's status is currently "Deferred."
Why It Matters
An attacker who succeeds can take control of pipelines, applications, users and API tokens on the affected Kubero instance.
Severity scores:
- CVSS 3.1: 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 4.0: 9.3 (Critical)
Both scores reflect a network attack with low complexity that needs no privileges and no user interaction. Confidentiality, integrity and availability impact are all rated high.
Exploitation status: no CISA KEV entry was supplied for this CVE, so the KEV catalog does not confirm active exploitation. The CVSS 4.0 exploit maturity field is "Not Defined."
What's Vulnerable
- Vendor: kubero-dev
- Product: Kubero
- Affected versions: 3.0.0 through 3.1.1 (inclusive)
- Trigger: the deployment runs without
JWT_SECRETset, so the hardcoded fallback secret is used
The vulnerable logic is in server/src/auth/strategies/jwt.strategy.ts, which is linked in the sources. NVD lists no CPE entries for this record.
Patch Status
The supplied NVD data does not name a fixed version or give vendor remediation guidance, and no CISA KEV required action or due date exists for this CVE. The affected range ends at 3.1.1. Operators should check the Kubero GitHub repository, issue #786 and the VulnCheck advisory for fix status.
Exposure depends on JWT_SECRET being unset, so operators running affected versions should check how that variable is configured in their deployments. Forged tokens can be used to control users and API tokens, so operators should also review those accounts and tokens on any instance that ran without JWT_SECRET set.