Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by Jacamar CI

    CVE-2026-107589 (GCVE-0-2026-107589)

    Vulnerability from nvd – Published: 2026-10-08 15:11 – Updated: 2026-10-08 19:14
    VLAI
    Title
    Authentication Bypass by Spoofing in Jacamar CI
    Summary
    Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
    Severity
    7.5 (High)
    CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 19:14 UTC
    CWE
    • CWE-290 - Authentication Bypass by Spoofing
    Assigner
    GitLab CNA under the mitre root
    CNA scorecard C 75/100 over 288 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Jacamar CI Jacamar CI Affected: 0 , < 0.30.0 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107589",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T19:14:02.778502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T19:14:14.226Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jacamar CI",
          "repo": "https://gitlab.com/ecp-ci/jacamar-ci",
          "vendor": "Jacamar CI",
          "versions": [
            {
              "lessThan": "0.30.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T15:11:04.585Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://ecp-ci.gitlab.io/docs/releasenotes/jacamar/jacamar_0.30.0.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue presents a serious risk to all versions of Jacamar CI prior to v0.30.0\nwhen used with GitLab Server v13.11 or later, or with v13.10 when the\n`allow_projects_to_create_service_accounts` feature flag enabled. If you are\nunable to immediately upgrade to the latest release, you can mitigate the risk by\nrestricting the allowed accounts or groups in the configuration, or by using the\nRunAs validation script to check for bot accounts. Please see the release notes for\na complete example."
        }
      ],
      "title": "Authentication Bypass by Spoofing in Jacamar CI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-107589",
    "datePublished": "2026-10-08T15:11:04.585Z",
    "dateReserved": "2026-10-08T11:33:21.365Z",
    "dateUpdated": "2026-10-08T19:14:14.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-107589 (GCVE-0-2026-107589)

    Vulnerability from cvelistv5 – Published: 2026-10-08 15:11 – Updated: 2026-10-08 19:14
    VLAI
    Title
    Authentication Bypass by Spoofing in Jacamar CI
    Summary
    Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
    Severity
    7.5 (High)
    CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 19:14 UTC
    CWE
    • CWE-290 - Authentication Bypass by Spoofing
    Assigner
    GitLab CNA under the mitre root
    CNA scorecard C 75/100 over 288 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Jacamar CI Jacamar CI Affected: 0 , < 0.30.0 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107589",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T19:14:02.778502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T19:14:14.226Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jacamar CI",
          "repo": "https://gitlab.com/ecp-ci/jacamar-ci",
          "vendor": "Jacamar CI",
          "versions": [
            {
              "lessThan": "0.30.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T15:11:04.585Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://ecp-ci.gitlab.io/docs/releasenotes/jacamar/jacamar_0.30.0.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue presents a serious risk to all versions of Jacamar CI prior to v0.30.0\nwhen used with GitLab Server v13.11 or later, or with v13.10 when the\n`allow_projects_to_create_service_accounts` feature flag enabled. If you are\nunable to immediately upgrade to the latest release, you can mitigate the risk by\nrestricting the allowed accounts or groups in the configuration, or by using the\nRunAs validation script to check for bot accounts. Please see the release notes for\na complete example."
        }
      ],
      "title": "Authentication Bypass by Spoofing in Jacamar CI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-107589",
    "datePublished": "2026-10-08T15:11:04.585Z",
    "dateReserved": "2026-10-08T11:33:21.365Z",
    "dateUpdated": "2026-10-08T19:14:14.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}