CVE-2026-82882— Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
Quick assessment
Affected
devtron-labs devtron
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Devtron 2.2.0 及更早版本在 的 GET 接口上未执行适当的授权检查，导致经过身份验证的用户能够获取管理员 API 令牌。任何拥有已认证账户的攻击者都可以通过传入任意项目、环境和应用参数来查询该端点，从而获取明文超级管理员 JWT 令牌，进而获得对整个平台的完全控制权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82882
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| devtron-labs | devtron | 0 ~ 2.2.0 | - |
|
II. Public POCs for CVE-2026-82882
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82882
请登录查看更多情报信息。
Other References for CVE-2026-82882 (5)
IV. Related Vulnerabilities
Same weakness: CWE-862
-
CVE-2026-82394
Sulu: Fix authorization bypass when creating preview links -
CVE-2026-71415
Kirby: File upload permissions are not checked during proces -
CVE-2026-81278
WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vu -
CVE-2026-81758
WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Contr -
CVE-2026-81762
WordPress Booking and Rental Manager plugin <= 2.7.6 - Broke
V. Comments for CVE-2026-82882
No comments yet