CVE-2026-42300: DevGuard: Authentication bypass via client-supplied X-Admin-Token header
DevGuard versions before 1.2.2 accept a client-supplied X-Admin-Token header as the authenticated user identifier when no Kratos session cookie is present. The CNA description states that an unauthenticated attacker who knows or can guess a target user's identity UUID could act as that user, including organisation admins or owners. Upgrading to 1.2.2 or later is the stated remedy.
Overview
DevGuard is a vulnerability management platform for the software supply chain. According to the CNA description, versions before 1.2.2 contain a session handling flaw in SessionMiddleware that trusts a client-supplied X-Admin-Token header as the authenticated user identifier when no Kratos session cookie is present.
Impact
An unauthenticated remote attacker who knows or can guess a target user's Kratos identity UUID may be able to act as that user. If the target is an organisation admin or owner, the description states this grants full control over that organisation's DevGuard resources. The GitHub CVSS 4.0 vector rates confidentiality, integrity and availability impact as high, with a base score of 9.3.
Affected products and versions
- L3montree-dev Devguard: versions before 1.2.2, per the affected list in the record.
- The fix is stated to be in 1.2.2. The record's fixes list is empty, so the advisory should be consulted for upgrade details.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the sources consulted, and no confirmed exploitation in the wild appears in those sources. The SSVC exploitation value is recorded as none. The EPSS probability is 0.00435 with a percentile of 0.36026.
Remediation and mitigation
- Upgrade DevGuard to version 1.2.2 or later.
- Review the referenced commit and the GitHub security advisory to confirm the change applied in your deployment.
- Until patching is complete, restrict network access to DevGuard instances and limit exposure to untrusted clients.
- If exposure is suspected, rotate administrative credentials and review recent organisation membership and permission changes.
Detection guidance
- Review application and proxy logs for requests without a session cookie that carry an X-Admin-Token header and receive successful responses.
- Audit actions performed by organisation owners and admins for activity that does not match expected users.
- Monitor for unexpected changes to memberships, roles or resource settings.
Limitations of the available information
The sources do not provide technical detail beyond the CNA description, the fixes list is empty, and no exploitation telemetry is available. Whether other deployment configurations are affected is unknown. The detection and mitigation steps above are inferred from the description rather than confirmed by a vendor.
Frequently asked questions
Which DevGuard versions are affected by CVE-2026-42300?
The record lists DevGuard versions before 1.2.2 as affected. The description states the vulnerability is fixed in 1.2.2.
Is this CVE known to be exploited in the wild?
CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is recorded as none.
What is the recommended action?
Upgrade DevGuard to version 1.2.2 or later, and review logs and organisation admin activity for signs of misuse if exposure is suspected.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.