It affects deployments where the JWT signing secret is not configured.In that condition, Kubero uses a hardcoded fallback signing key. An unauthenticated remote attacker may forge an administrative token and gain control of pipelines, applications, users, and API tokens.
What it allows
How Does CVE-2026-125370 Bypass Kubero Authentication?
Kubero expects administrators to configure a secret for signing JSON Web Tokens. When that setting is absent, affected releases use a hardcoded fallback key instead.
An attacker who knows the fallback can create a token carrying chosen roles, groups, and permissions. Kubero trusts those claims without checking them against its database.
The forged identity can receive administrative access without valid credentials or user interaction. The advisory says this may expose control over pipelines, applications, users, and API tokens.
This is an authentication-token trust failure, not a password-guessing attack. Defenders should prioritize internet-reachable or otherwise untrusted-network deployments.
Who is affected
Kubero versions 3.0.0 through 3.1.1 are affected when the JWT signing secret is unset. The public records do not identify a patched version.
Administrators should inventory affected versions and verify that every deployment has a unique, unpredictable signing secret. Track remediation through the vulnerability management process until Kubero publishes an applicable fixed release.
What to do
-
Identify Kubero 3.0.0 through 3.1.1 deployments
Inventory every affected installation and prioritize instances reachable from untrusted networks. Confirm the installed version directly instead of relying only on asset records.
-
Set a unique JWT signing secret
Brandefense recommends configuring a unique, unpredictable signing secret on every deployment. Verify the application uses that value and does not fall back to the hardcoded key.
-
Rotate signing material and API tokens
Brandefense recommends replacing the JWT signing secret and rotating exposed API tokens. Invalidate existing sessions so tokens signed with earlier material cannot remain trusted.
-
Restrict access while remediation is underway
Limit Kubero administration access to trusted management paths. Remove direct exposure to untrusted networks until the configuration is verified and an applicable fixed release is available.
-
Review administrative activity
Review user, permission, pipeline, application, and API-token changes for unexpected activity. Preserve relevant evidence and follow the incident response plan when anomalies appear.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-125370?
It is a critical authentication bypass in Kubero. A hardcoded fallback signing key may let an unauthenticated remote attacker forge an administrative JWT.
Which Kubero versions are affected by CVE-2026-125370?
Kubero versions 3.0.0 through 3.1.1 are affected when the JWT signing secret is unset. The public records do not identify a patched version.
What can an attacker access through the Kubero authentication bypass?
The advisory says forged administrative claims may provide control over pipelines, applications, users, and API tokens.
Does CVE-2026-125370 require credentials or user interaction?
No. Both NVD vectors record network access, low complexity, no privileges, and no user interaction. The vulnerable condition requires the signing secret to be unset.
How should defenders respond before a fixed Kubero release is identified?
Configure a unique signing secret, rotate signing material and API tokens, invalidate sessions, restrict access, and review administrative changes. These are Brandefense recommendations.
Sources
- GitHub Advisory GHSA-42fc-m93g-j65wGitHub
- NVD: CVE-2026-125370NIST NVD
