CVE-2026-92720
Last modified
CVE-2026-92720 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations..
Description
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| kubero-dev | kubero | <= 3.1.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-92720?
How severe is CVE-2026-92720?
How do I fix CVE-2026-92720?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92714The Download Manager plugin for WordPress is vulnerable to I…6.5
- CVE-2026-92716Shuffle through 2.2.1 contains a cross-tenant privilege esca…9.6
- CVE-2026-92717Covenant through 0.6 registers the CovenantHub SignalR hub w…9.1
- CVE-2026-92718Nuclei versions before 3.11.1 cache template signature verif…7.3
- CVE-2026-92719Quickwit through 0.9.0 fails to validate the host and scheme…7.5
- CVE-2026-9272In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5,…8.1
- CVE-2026-92729SigNoz versions 0.88.0 through 0.141.0 fail to apply authori…8.2
- CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
- CVE-2026-9274This vulnerability exists in CP Plus Wi-Fi Camera due to imp…5.2
- CVE-2026-92745A flaw was found in cockpit-machines. This vulnerability all…5
- CVE-2026-92747A flaw was found in `cockpit-machines`. This vulnerability a…5
- CVE-2026-92748BC Security Empire before 6.7.1 fails to validate the multip…8.8
Are you affected by CVE-2026-92720?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST