8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25538

CVE-2026-25538: Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage

Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25538

CVE-2026-25538:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/devtron-labs/devtron	go	<= 2.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a critical missing authorization flaw in the Devtron Attributes API. The core issue is that several API handlers in api/restHandler/AttributesRestHandlder.go did not properly enforce authorization, allowing any authenticated user to read sensitive configuration data. The vulnerability description explicitly points out that the RBAC enforcement code was commented out in the GetAttributesByKey function.

The analysis of the patch commit d2b0d260d858ab1354b73a8f50f7f078ca62706f confirms this. The patch introduces a mechanism to classify certain attributes as internal-only (specifically the apiTokenSecret) and adds checks in multiple handler functions (GetAttributesByKey, GetAttributesById, GetAttributesActiveList) to prevent these attributes from being read through the API.

An attacker could exploit this by making a simple authenticated GET request to endpoints like /orchestrator/attributes?key=apiTokenSecret. This would return the HMAC-SHA256 signing key for all API JWT tokens. With this key, the attacker can forge JWT tokens for any user, including administrators, granting them complete control over the Devtron platform and potentially allowing lateral movement to the underlying Kubernetes cluster. The identified vulnerable functions are the direct entry points for this attack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.