{"id":"CVE-2026-42300","aliases":["GHSA-2g9v-7mr5-fgjg","GO-2026-4988"],"url":"https://o3.security/vulnerability/CVE-2026-42300","summary":"DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header","details":"### Impact\nThe `SessionMiddleware` accepts a client-supplied `X-Admin-Token` HTTP request header and uses its raw string value as the authenticated `userID` when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation `admin` or `owner`, this gives the attacker full control over that organisation's DevGuard resources.\n\n### Patches\nThe release v1.2.2 patches this issue. Update your DevGuard API Instances to this version.\n\n### Workarounds\nConfigure a reverse proxy to strip the `X-Admin-Token` header before sending requests to the DevGuard API.\n\n### Resources\nFixed commit: https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a","published":"2026-05-12T17:25:20.435Z","modified":"2026-10-28T02:30:51.498408182Z","cvss":null,"epss":{"score":0.00257,"percentile":0.16988,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/l3montree-dev/devguard","fixedVersion":"1.2.2"}],"fix":{"url":"https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a","label":"l3montree-dev/devguard@6f38310"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42300.json"},{"type":"ADVISORY","url":"https://github.com/l3montree-dev/devguard/security/advisories/GHSA-2g9v-7mr5-fgjg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42300"},{"type":"FIX","url":"https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a"},{"type":"PACKAGE","url":"https://github.com/l3montree-dev/devguard"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:51.498408182Z"}}