CVE-2026-82882

Devtron through version 2.2.0 does not enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint (CWE-862), leaving token retrieval gated only by authentication. Any user holding an authenticated account, regardless of assigned role, project, or environment, can call the endpoint with arbitrary project, environment, and application parameters and receive plaintext super-admin JWT API tokens in the response. With a super-admin token, an attacker gains full control of the Devtron platform, which orchestrates application delivery to connected Kubernetes clusters. All Devtron deployments running version 2.2.0 or earlier are affected, and any account on those platforms — including low-privilege ones — is sufficient to exploit the flaw. No public proof-of-concept is known, the vulnerability is not in CISA's KEV, and EPSS currently assigns it a low 0.3% probability of exploitation within the next 30 days.

What to do: Upgrade Devtron to a release newer than 2.2.0 once a patched version is available, since the flaw affects all versions through 2.2.0. As an interim mitigation, restrict access to the /orchestrator/api-token/webhook endpoint (e.g., block or proxy-limit it at the ingress/reverse-proxy layer) and minimize the number of accounts that can authenticate to the orchestrator. Review whether super-admin tokens were issued or used by non-administrative accounts and rotate them if compromise is suspected.