GitHub Advisoryadvisory · Go

GHSA-2g9v-7mr5-fgjg DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

CRITICAL Published 2026-05-05 Modified 2026-05-13 Official page ↗
Aliases
CVE-2026-42300
Ecosystem
Go
Packages
github.com/l3montree-dev/devguard
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-288
Reviewed
2026-05-05

Affected packages

• Go github.com/l3montree-dev/devguard: < 1.2.2 → fixed in 1.2.2

Description

Impact The `SessionMiddleware` accepts a client-supplied `X-Admin-Token` HTTP request header and uses its raw string value as the authenticated `userID` when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation `admin` or `owner`, this gives the attacker full control over that organisation's DevGuard resources. Patches The release v1.2.2 patches this issue. Update your DevGuard API Instances to this version. Workarounds Configure a reverse proxy to strip the `X-Admin-Token` header before sending requests to the DevGuard API. Resources Fixed commit: https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a

Related

Alias · CVE (1)

  • CVE-2026-42300 DevGuard provides vulnerability management for the full software supply chain. vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References