CVE-2026-107589
Authentication Bypass by Spoofing in Jacamar CI
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Authentication Bypass by Spoofing in Jacamar CI
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
- Record
CVE-2026-107589- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-290
- Updated
- 2026-11-02
EUVDEUVD-2026-95036
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
- Record
EUVD-2026-95036- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x75h-475x-5665
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows...
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
- Record
GHSA-x75h-475x-5665- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-290
- Updated
- 2026-11-02
NVD
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
- Record
CVE-2026-107589- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-290
- Updated
- 2026-11-02
OSV
Authentication Bypass by Spoofing in Jacamar CI
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
- Record
CVE-2026-107589- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-290
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107589 is a high vulnerability (CVSS 7.5) in Jacamar Ci Ci, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. No source names a fixed version.