GHSA-2G9V-7MR5-FGJG严重已审查

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

OSV 1.4.0 · github-reviewed · 修改于 2026-05-14 00:26

发布时间

2026-05-06 04:58

GitHub 审查时间

2026-05-06 04:58

NVD 发布时间

2026-05-13 02:17

源文件

advisories/github-reviewed/2026/05/GHSA-2g9v-7mr5-fgjg/GHSA-2g9v-7mr5-fgjg.json

公告说明

Impact

The SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources.

Patches

The release v1.2.2 patches this issue. Update your DevGuard API Instances to this version.

Workarounds

Configure a reverse proxy to strip the X-Admin-Token header before sending requests to the DevGuard API.

Resources

Fixed commit: https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a

受影响的软件包

github.com/l3montree-dev/devguard

标识信息

别名 / CVE

CVE-2026-42300

CWE

CWE-288

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-2g9v-7mr5-fgjg",
  "aliases": [
    "CVE-2026-42300"
  ],
  "details": "### Impact\nThe `SessionMiddleware` accepts a client-supplied `X-Admin-Token` HTTP request header and uses its raw string value as the authenticated `userID` when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation `admin` or `owner`, this gives the attacker full control over that organisation's DevGuard resources.\n\n### Patches\nThe release v1.2.2 patches this issue. Update your DevGuard API Instances to this version.\n\n### Workarounds\nConfigure a reverse proxy to strip the `X-Admin-Token` header before sending requests to the DevGuard API.\n\n### Resources\nFixed commit: https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a",
  "summary": "DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.2"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/l3montree-dev/devguard",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2026-05-13T16:26:37Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-05-05T20:58:27Z",
  "references": [
    {
      "url": "https://github.com/l3montree-dev/devguard/security/advisories/GHSA-2g9v-7mr5-fgjg",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42300",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a",
      "type": "WEB"
    },
    {
      "url": "https://github.com/l3montree-dev/devguard",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-288"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2026-05-12T18:17:24Z",
    "github_reviewed_at": "2026-05-05T20:58:27Z"
  }
}