The vulnerability allows attackers to forge administrative JSON Web Tokens by exploiting a hard‑coded fallback secret when the JWT_SECRET environment variable is not set. Because the authentication strategy trusts these forged tokens without performing a database lookup, malicious actors can insert arbitrary role, userGroups, and permissions claims to gain full controller power over pipelines, applications, users, and API tokens. This effectively bypasses the entire authentication system, providing complete administrative authority.

The affected product is Kubero developed by kubero‑dev. Versions 3.0.0 through 3.1.1 are vulnerable because they contain the hard‑coded fallback signing secret. Any deployment of these releases without a custom JWT_SECRET is at risk.

The CVSS score of 9.3 indicates critical severity, and the lack of an EPSS score does not negate the high likelihood of exploitation given the trivial requirement of setting a missing environment variable. Attackers only need unauthenticated remote access to sign a token, which the JwtStrategy.validate() accepts unconditionally. Because the vulnerability is not listed in the CISA KEV catalog, there are no publicly known exploits yet, but the controlling of privileged actions presents a catastrophic risk to the infrastructure.