Kubero Authentication Bypass Lets Remote Attackers Forge Admin JWTs

Kubero versions 3.0.0 through 3.1.1 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs.

The issue is caused by a hardcoded fallback signing secret used when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, and JwtStrategy.validate() trusts these tokens without a database lookup.

• Take control of pipelines
• Take control of applications
• Take control of users
• Take control of API tokens