External risk intelligence

Kubero Authentication Bypass via Hardcoded JWT Secret

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-125370

Kubero is a platform for managing pipelines and applications, typically deployed as a web-based management interface or API. Such services are commonly exposed as internet-facing or internal-facing web portals to facilitate remote access for developers and administrators, making them a likely target for network-based interaction.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Kubero software could allow unauthorized individuals to bypass authentication. This could enable attackers to gain control over critical functions, applications, and user access by creating forged security tokens.

Attackers can impersonate administrators easily.
It affects the core security of Kubero-managed systems.
Confirm relevance and exposure of Kubero instances.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by exploiting a flaw in Kubero's JWT handling. If the secret key for signing JWTs is not configured, the system defaults to a hardcoded value. An attacker can leverage this by creating their own JWTs with administrative privileges, which the system will trust without verifying against a database. This allows them to gain control over pipelines, applications, users, and API tokens.

No authentication is required.
Forging JWTs with administrative claims.
Gains control of pipelines and applications.

Live Threat

Current exploitation, exposure, and threat context

When Kubero's JWT secret is not configured, unauthenticated remote attackers could forge administrative JSON Web Tokens. This could allow them to impersonate users and gain unauthorized access to control pipelines, applications, user accounts, and API tokens within the affected system.

Control over pipelines and applications.
Forge JWTs using a hardcoded secret.
Complete system compromise is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Kubero, a platform for managing pipelines and applications. The first practical step is for platform or application owners to identify all instances of Kubero, determine their reachability and business criticality, and then coordinate remediation efforts.

Platform or application owners should address.
Verify Kubero instances and their exposure.
Plan and execute remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kubero and how is it used?

Kubero is a software platform designed for managing application pipelines and deployments. It provides a web-based interface and API, acting as a control plane that helps developers and administrators oversee their services, manage user access, and handle API tokens within their infrastructure.

What does CVE-2026-125370 mean for security?

This vulnerability is an authentication bypass, classified as CWE-321: Use of a Hard-coded Cryptographic Key. It occurs because the software falls back to a preset, known secret key when the custom JWT_SECRET is not configured. This flaw allows an attacker to generate valid administrative login tokens, tricking the system into granting them full control without checking legitimate user credentials.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a forged JSON Web Token (JWT) to the system. Because the software accepts this hardcoded secret as valid, the attacker does not need prior access, passwords, or valid accounts to enter. Note that if a unique, strong JWT_SECRET is correctly configured, the hardcoded fallback is not used, which prevents this specific bypass path.

Is my instance of Kubero at risk?

Halo Surface Signal indicates that Kubero is commonly deployed as a web-accessible service, making it a likely target for network-based interaction. If your instance is internet-facing, it is at higher risk of being discovered and targeted by remote attackers. You should assess whether your specific deployments are exposed to the public internet or restricted to internal networks.

How should I respond to this threat?

First, inventory your environment to locate all running instances of Kubero. Check the configuration of each instance to verify if the JWT_SECRET is properly set to a unique, non-default value. If it is unset or using a default, treat the system as compromised, restrict its network access immediately, and coordinate with your security team to remediate the configuration.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.