Description

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-31T22:17:31.940Z",
  "pubdate": "2026-08-31T22:17:31.940Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw identified in Devtron versions up to 2.2.0. The vulnerability resides within the orchestrator's webhook API endpoint, which fails to validate the authorization level of the requesting user. Consequently, any authenticated user—regardless of their assigned role or permission set—can bypass access control mechanisms to retrieve sensitive super-admin JWT tokens.\nThe impact of this vulnerability is critical, as it grants an attacker full administrative control over the entire Devtron platform. By querying the GET /orchestrator/api-token/webhook endpoint with crafted parameters, an attacker can obtain plaintext credentials required to execute privileged actions across all projects, environments, and applications. This represents a complete compromise of the platform's confidentiality, integrity, and availability. The exploit requires valid authentication but does not necessitate elevated privileges, lowering the barrier for entry for malicious actors with standard, low-privileged platform access. Organizations utilizing Devtron 2.2.0 or earlier are at immediate risk of full-scale system takeover if an unauthorized user gains access to the application interface.",
  "technicalDetails": "The root cause of this vulnerability is a missing authorization check within the backend logic of the /orchestrator/api-token/webhook endpoint. In Devtron architecture, this endpoint is intended to facilitate administrative orchestration tasks, but the implementation lacks a mandatory check against the user's role-based access control (RBAC) profile. Because the application fails to verify if the requester possesses sufficient administrative privileges, the API processes the request regardless of the identity context provided in the session token.\nThe exploitation flow is straightforward and does not require advanced techniques. An attacker authenticated with a standard user account can interact directly with the Devtron orchestrator API. By submitting a GET request to the /orchestrator/api-token/webhook endpoint, the attacker provides manipulated project, environment, and application parameters as input. The application backend, failing to validate these inputs against authorized project scopes, generates and returns the corresponding super-admin JWT tokens in the HTTP response body.\nThe vulnerability affects all Devtron versions up to and including 2.2.0. The target component is the orchestrator API service, specifically the controller responsible for token provisioning via webhooks. Since the orchestrator is central to managing Kubernetes clusters and CI/CD pipelines within Devtron, the retrieval of a super-admin JWT token allows the attacker to authenticate as the super-user in all subsequent requests. This effectively bypasses all internal resource isolation policies.\nPost-exploitation, an attacker can leverage the retrieved JWT to manipulate deployment configurations, access sensitive environment secrets, modify cluster targets, or deploy malicious workloads. This provides persistent platform control, enabling the attacker to pivot into integrated Kubernetes clusters, intercept sensitive traffic, or exfiltrate configuration data. Given the network exposure typical of CI/CD orchestration tools, this endpoint is inherently reachable by anyone with internal application access, making it a high-value target for lateral movement within a cloud-native development environment."
}