8.8

CVE-2026-25538: devtron-labs devtron Missing Authorization

CVSS: 8.8v3.1HighAnalyzed
AliasesGHSA-8wpc-j9q9-j5m2GO-2026-4416
Published 04-02-2026Last modified 05-02-2026
Open JSON

Vulnerability summary

CVE-2026-25538 is a high (CVSS 8.8) Missing Authorization vulnerability in devtron-labs devtron. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
0.54%
0%100%
Low · +0.13 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2026:21483-1SUSE-SU-2026:0403-1

Timeline

  1. 04-02-2026
    PublishedVulnerability first disclosed.
  2. 05-02-2026
    Last modifiedVulnerability information updated.

Description

Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.54%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

+0.13 pp

From 0.41% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Devtron

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Devtron1 product
Devtron-labs1 product
Github.com/devtron-labs1 product
  • devtron≤ 2.0.0 | All versions (No fix recorded)

3 vendors · 3 products

References

4 links