Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2026-25538

8.8 · HIGH
Published Feb 4, 2026 devtron CWE-862

Overview

CVE-2026-25538 is a high-severity vulnerability affecting devtron devtron. It was published on February 4, 2026 and has a CVSS 3.1 base score of 8.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 8.8, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26.

Remediation

Check the references section for vendor advisories and patches from devtron. Update devtron to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor Product Versions Status
devtron devtron >= 0, < 2.0.0 Affected

Frequently Asked Questions

What is CVE-2026-25538?

CVE-2026-25538 is a high-severity vulnerability affecting devtron devtron. It was published on February 4, 2026 and has a CVSS 3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-25538?

This vulnerability has a CVSS 3.1 base score of 8.8, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-25538?

Check the references section for vendor advisories and patches from devtron. Update devtron to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-25538?

CyberStrike's AI-powered security agents can automatically detect CVE-2026-25538 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

Browse by year 2026