CVE-2026-25538
JWT Forgery via API Token Leak in Devtron Attributes API
Publication date: 2026-02-04
Last updated on: 2026-02-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devtron | devtron | to 2.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Devtron, an open source tool integration platform for Kubernetes, specifically in versions 2.0.0 and prior. It affects the Attributes API interface, where any authenticated user, including those with low privileges such as CI/CD Developers, can access the /orchestrator/attributes?key=apiTokenSecret endpoint to obtain the global API Token signing key.
With this key, an attacker can forge JWT tokens for arbitrary user identities offline, which allows them to gain complete control over the Devtron platform and potentially move laterally to the underlying Kubernetes cluster.
This vulnerability has been patched in a later commit (d2b0d26).
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to gain complete control over the Devtron platform by forging JWT tokens for any user identity.
This control can lead to unauthorized actions within the platform and enable lateral movement to the underlying Kubernetes cluster, potentially compromising the entire cluster and its workloads.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Devtron to a version that includes the patch applied in commit d2b0d26.
This patch fixes the issue in the Attributes API interface that allowed authenticated users to obtain the global API Token signing key.