Kubero npm Package Vulnerability: Critical Authentication Bypass
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- kubero (npm)
- Affected versions
- >= v3.1.1, <= v3.1.1 or >= v3.1.0, <= v3.1.0 or >= v3.0.1, <= v3.0.1 or >= v3.0.0, <= v3.0.0 or >= v2.4.7, <= v2.4.7 or >= v2.4.6, <= v2.4.6 or >= v2.4.5, <= v2.4.5 or >= v2.4.4, <= v2.4.4 or >= v2.4.4-rc.1, <= v2.4.4-rc.1 or >= v2.4.3, <= v2.4.3 or >= v2.4.1, <= v2.4.1 or >= v2.4.0, <= v2.4.0 or >= v2.3.3, <= v2.3.3 or >= v2.3.2, <= v2.3.2 or >= v2.3.1, <= v2.3.1 or >= v2.3.0, <= v2.3.0 or >= v2.2.1, <= v2.2.1 or >= v2.2.0, <= v2.2.0 or >= v2.1.1, <= v2.1.1 or >= v2.1.0, <= v2.1.0 or >= v2.0.3, <= v2.0.3 or >= v2.0.2, <= v2.0.2 or >= v2.0.1, <= v2.0.1 or >= v2.0.0, <= v2.0.0 or >= v1.11.5, <= v1.11.5 or >= v1.11.4, <= v1.11.4 or >= v1.11.3, <= v1.11.3 or >= v1.11.2, <= v1.11.2 or >= v1.11.1, <= v1.11.1 or >= v1.11.0, <= v1.11.0 or >= v1.10.0-beta.2, <= v1.10.0-beta.2 or >= v1.10.2, <= v1.10.2 or >= v1.10.1, <= v1.10.1 or >= v1.10.0, <= v1.10.0 or >= v1.10.0-beta, <= v1.10.0-beta or >= v1.10.0-beta.1, <= v1.10.0-beta.1 or >= v1.9.9, <= v1.9.9 or >= v1.9.8, <= v1.9.8 or >= v1.9.7, <= v1.9.7 or >= v1.9.6, <= v1.9.6 or >= v1.9.5, <= v1.9.5 or >= v1.9.4, <= v1.9.4 or >= v1.9.3, <= v1.9.3 or >= v1.9.2, <= v1.9.2 or >= v1.9.1, <= v1.9.1 or >= v1.9.0, <= v1.9.0 or >= v1.8.4, <= v1.8.4 or >= v1.8.3, <= v1.8.3 or >= v1.8.2, <= v1.8.2 or >= v1.8.1, <= v1.8.1 or >= v1.8.0, <= v1.8.0 or >= v1.7.1, <= v1.7.1 or >= v1.7.0, <= v1.7.0 or >= v1.6.1, <= v1.6.1 or >= v1.6.0, <= v1.6.0 or >= v1.5.3, <= v1.5.3 or >= v1.5.2, <= v1.5.2 or >= v1.5.1, <= v1.5.1 or >= v1.5.0, <= v1.5.0 or >= v1.4.4, <= v1.4.4 or >= v1.4.3, <= v1.4.3 or >= v1.4.2, <= v1.4.2 or >= v1.4.1, <= v1.4.1 or >= v1.4.0, <= v1.4.0 or >= v1.3.3, <= v1.3.3 or >= v1.3.2, <= v1.3.2 or >= v1.3.1, <= v1.3.1 or >= v1.3.0, <= v1.3.0 or >= v1.2.0, <= v1.2.0 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Kubero npm package. This vulnerability allows unauthenticated access to sensitive data.
What happened
Kubero versions from v1.0.0 through v3.1.1 reportedly fail to apply authentication guards to notifications API endpoints. This allows unauthenticated attackers to read webhook secrets and service URLs. Attackers could retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.
This vulnerability is currently under investigation. No exploitation in the wild has been confirmed. Users of affected versions should take immediate action to secure their systems.
What to do about it
- Upgrade to a version of Kubero that includes the fix for this vulnerability.
- Review existing webhook configurations for any signs of tampering.
- Monitor the primary sources for updates on this vulnerability.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
kubero is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Kubero npm package versions from v1.0.0 through v3.1.1, you are affected.
What should I do right now?
Upgrade to a version of Kubero that includes the fix for this vulnerability and review existing webhook configurations for any signs of tampering.
Is there an official fix available?
No official fix has been published yet. Monitor the sources below for updates.