What is GHSA-2g9v-7mr5-fgjg?

GHSA-2g9v-7mr5-fgjg is a security advisory published by GitHub Security Advisories with Critical severity. DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

Which CVE IDs does GHSA-2g9v-7mr5-fgjg cover?

GHSA-2g9v-7mr5-fgjg covers the following CVE IDs: CVE-2026-42300. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-2g9v-7mr5-fgjg?

GHSA-2g9v-7mr5-fgjg affects 1 product, including: go/github.com/l3montree-dev/devguard:\u003c 1.2.2.

GHSA-2g9v-7mr5-fgjgCritical

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

Vendor

GitHub Security Advisories

Published

May 5, 2026

Last Modified

May 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-42300 →

📋 Description

Impact

The SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources.

Patches

The release v1.2.2 patches this issue. Update your DevGuard API Instances to this version.

Workarounds

Configure a reverse proxy to strip the X-Admin-Token header before sending requests to the DevGuard API.

Resources

Fixed commit: https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a

🎯 Affected products1

go/github.com/l3montree-dev/devguard:< 1.2.2