{"answers":{"affected":"3 open source packages ship an affected version, including github.com/devtron-labs/devtron. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25538 exists.","fix":"Apply the vendor's patch.","what":"CVE-2026-25538 is a high-severity missing authorization vulnerability in devtron-labs devtron, published on 4 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-25538 and fix it if it is affected.\n\nWhat it is: CVE-2026-25538 is a high-severity missing authorization vulnerability in devtron-labs devtron, published on 4 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25538 exists.\n\nAffected packages and fixed versions:\n- github.com/devtron-labs/devtron (Go): affected all versions; no fix listed\n- github.com/devtron-labs/devtron (Go): affected all versions up to 2.0.0; no fix listed\n- github.com/devtron-labs/devtron (Go): affected all versions up to 2.0.0; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-25538/ (Markdown: https://insights.sbomify.com/CVE-2026-25538/index.md)","id":"CVE-2026-25538","markdown":"https://insights.sbomify.com/CVE-2026-25538/index.md","name":"CVE-2026-25538","record":{"aliases":["GHSA-8wpc-j9q9-j5m2","GO-2026-4416"],"analysis":{"component_type":"cloud_service","fix_type":"patch","impacts":["privilege_escalation","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Kubernetes integration platform","requires_auth":"low_privilege","summary":"Low-privileged users can access an API endpoint to leak the signing key, allowing them to forge tokens and gain full control over the Devtron platform and Kubernetes cluster.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"devtron","vendor":"devtron"}],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"description":"Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage","id":"CVE-2026-25538","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE","id":"CVE-2026-25539"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/devtron-labs/devtron","purl":"pkg:golang/github.com/devtron-labs/devtron","source":"GO-2026-4416"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["2.0.0"],"package":"github.com/devtron-labs/devtron","purl":null,"source":"GHSA-8wpc-j9q9-j5m2"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["2.0.0"],"package":"github.com/devtron-labs/devtron","purl":"pkg:golang/github.com/devtron-labs/devtron","source":"GHSA-8wpc-j9q9-j5m2"}],"prev":{"headline":"jsonwebtoken has Type Confusion that leads to potential authorization bypass","id":"CVE-2026-25537"},"products":["devtron"],"published":"2026-02-04","related":[{"cvss_score":8.3,"headline":"SQL Injection in CreateUser API in devtron","id":"CVE-2024-45794","kev_date_added":null,"published":"2024-11-07"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-02-05","vendors":["devtron-labs"]},"summary":"Low-privileged users can access an API endpoint to leak the signing key, allowing them to forge tokens and gain full control over the Devtron platform and Kubernetes cluster.","url":"https://insights.sbomify.com/CVE-2026-25538/"}