CVE-2026-107589 Details
Description
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
A vulnerability in Jacamar CI prior to version 0.30.0 allows authenticated CI users to create arbitrary account names for service accounts. This issue arises from inadequate validation of job requests associated with service accounts, particularly when Jacamar CI is used with GitLab Server versions 13.10 (with a specific feature flag enabled) or 13.11 and later.
Users are advised to upgrade to Jacamar CI version 0.30.0 or later. If an immediate upgrade is not possible, a validation script can be implemented to reject jobs triggered by bot accounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://ecp-ci.gitlab.io/docs/releasenotes/jacamar/jacamar_0.30.0.html | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jacamar CI | < 0.30.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |