Executive brief
Kubero is a self-hosted platform-as-a-service alternative for deploying applications on Kubernetes. The product fails to enforce authentication on its notifications API endpoints, allowing anyone with network access to retrieve sensitive webhook secrets, service URLs, and stored credentials. Attackers can abuse this to intercept pipeline events, inject malicious webhooks, or disable alerting by deleting webhook configurations.
Technical details
The vulnerability is an authentication bypass affecting the notifications API endpoints in Kubero through version 3.1.1. The REST API endpoints handling webhook configuration lack proper authentication guards (auth middleware/decorators), allowing unauthenticated HTTP requests to access sensitive resources. An attacker with network access to the Kubero instance can read webhook credentials, retrieve service URLs, register malicious webhook receivers, or delete existing notification configurations. The application uses NestJS with JWT-based bearer token authentication, but these specific endpoints do not enforce it. No patch status is provided in the advisory.
Affected products
- Kubero Kubero through 3.1.1
Timeline
- 2026-09-16: disclosed