PT-2026-37260 · Devguard · Devguard

Published 2026-05-05 · Updated 2026-05-20 · CVE-2026-42300

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DevGuard versions prior to 1.2.2

Description An authentication bypass exists in the SessionMiddleware where the system accepts a client-supplied X-Admin-Token HTTP request header. When no Kratos session cookie is present, the raw string value of this header is used as the authenticated userID. An unauthenticated attacker who possesses or guesses a target user's Kratos identity UUID can issue requests as that user. If the target user is an organization admin or owner, the attacker can gain full administrative control over the organization's resources.

Recommendations Update to version 1.2.2. Configure a reverse proxy to strip the X-Admin-Token header before sending requests to the API.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-42300

GHSA-2G9V-7MR5-FGJG

GO-2026-4988

Affected Products

Devguard

References · 8

• https://osv.dev/vulnerability/GHSA-2g9v-7mr5-fgjg · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42300 · Security Note
• https://github.com/l3montree-dev/devguard · Note
• https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a · Note
• https://github.com/l3montree-dev/devguard/security/advisories/GHSA-2g9v-7mr5-fgjg · Note
• https://twitter.com/CVEnew/status/2054340988361941408 · Twitter Post
• https://twitter.com/UpwindMDR/status/2051940598907548024 · Twitter Post