TI-2026-30608 Aliases CVE-2026-42300 GHSA-2g9v-7mr5-fgjg

DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header

MEDIUM 48CWE-288Published 2026-05-12 · Updated 2026-05-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-288.

Summary

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources. This vulnerability is fixed in 1.2.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00257 17th percentileScored 2026-11-07

Fix Fixed devguard (l3montree-dev): 1.2.2github.com/l3montree-dev/devguard (Go): 1.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
l3montree-dev	devguard	before 1.2.2	1.2.2	Patch available	CNA
—	github.com/l3montree-dev/devguard (Go)	before 1.2.2	1.2.2	Patch available	GHSA-2g9v-7mr5-fgjg

devguard Vendorl3montree-dev Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
github.com/l3montree-dev/devguard (Go) Vendor— Affected before 1.2.2 Fixed in 1.2.2 Patch available GHSA-2g9v-7mr5-fgjg

Remediation

Fix · CNA devguard (l3montree-dev) Fixed in 1.2.2
Fix · GHSA-2g9v-7mr5-fgjg github.com/l3montree-dev/devguard (Go) Fixed in 1.2.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-42300
2026-10-03 Alias added: GHSA-2g9v-7mr5-fgjg

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-42300

Other 3

TI-2026-35530 DevGuard has improper authorization on public assets CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences