CVE-2026-92720

Kubero, a self-hosted PaaS for deploying applications on Kubernetes, fails to enforce authentication on its notifications API endpoints through version 3.1.1 (CWE-306). Any unauthenticated attacker with network access to the Kubero API can call these endpoints directly, with no privileges or user interaction required (CVSS 4.0: 9.3 critical, AV:N/PR:N). An attacker can read stored webhook secrets and service URLs, harvest credentials for connected notification services, register malicious webhooks to intercept pipeline event data, or delete existing webhook configurations to suppress alerting. All deployments running Kubero up to and including 3.1.1 are affected, especially those with the API reachable from untrusted networks. There is currently no known public proof-of-concept, the issue is not listed in CISA's KEV, and exploitation has not been observed in the wild.

What to do: Upgrade Kubero to the latest patched release once available (the flaw affects everything through 3.1.1) and restrict network access to the Kubero API/dashboard port via firewall rules, VPN, or an authenticating reverse proxy. Rotate any webhook secrets and service credentials that were configured in Kubero's notification integrations, and audit the notifications configuration for unrecognized webhooks or deleted alerting entries that could indicate compromise.