CVE-2026-92720
Last modified
CVE-2026-92720 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.. EPSS estimates a 0.63% chance of exploitation in the next 30 days.
Description
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| kubero-dev | kubero | <= 3.1.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92720?
How severe is CVE-2026-92720?
How do I fix CVE-2026-92720?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92715The Tutor LMS – eLearning and online course solution plugin …4.3
- CVE-2026-92716Shuffle through 2.2.1 contains a cross-tenant privilege esca…9.6
- CVE-2026-92717Covenant through 0.6 registers the CovenantHub SignalR hub w…9.1
- CVE-2026-92718Nuclei versions before 3.11.1 cache template signature verif…7.3
- CVE-2026-92719Quickwit through 0.9.0 fails to validate the host and scheme…7.5
- CVE-2026-9272In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5,…8.1
- CVE-2026-92727The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Revie…6.4
- CVE-2026-92729SigNoz versions 0.88.0 through 0.141.0 fail to apply authori…8.2
- CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
- CVE-2026-92730LimeSurvey Community Edition 7.0.14 contains a reflected cro…7.4
- CVE-2026-9274This vulnerability exists in CP Plus Wi-Fi Camera due to imp…5.2
- CVE-2026-92744Under certain conditions, privilege manager agent allows a r…8.7
Are you affected by CVE-2026-92720?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST