Bug: Security vulnerabilities in devtron

[012git012]

📜 Description

Hello!

Our team would like to inform you that security vulnerabilities were discovered in devtron. We submitted reports to you on August 1 (https://github.com/devtron-labs/devtron/security/advisories/new), but it's almost a months with no response.

Please be informed that our team plans to release a technical research, which will include details of the discovered vulnerabilities.

Please note, according to our policy, we reserve the right to publicly disclose our findings, if we do not receive a response from you within 90 days.
Planned disclosure date: October, 30 2025.

We kindly ask you to review our request and get back to us as soon as possible.

Look forward to hearing from you.

👟 Reproduction steps

👍 Expected behavior

👎 Actual Behavior

☸ Kubernetes version

Cloud provider

🌍 Browser

Chrome

🧱 Your Environment

No response

✅ Proposed Solution

No response

👀 Have you spent some time to check if this issue has been raised before?

• I checked and didn't find any similar issue

🏢 Have you read the Code of Conduct?

• I have read the Code of Conduct

[prakarsh-dt]

Hi @012git012,

Thank you for responsibly disclosing these vulnerabilities and for following up with us here. We sincerely apologize for the delay in getting back to you.

We will recheck our internal notifications right away and get back to you on the advisory thread.

We appreciate your patience and the effort you’ve put into identifying and reporting these issues. Our team will review your reports, work on appropriate fixes, and keep you updated throughout the process.

[012git012]

Hello @prakarsh-dt @vikramdevtron,

Thank you for fixing the reported vulnerabilities. Our team has left some comments — please review them in the advisories.
We also suspect that one of the vulnerabilities may not have been fully remediated, and we kindly ask you to check it.

Thank you in advance.

[systemsdt]

Hi @012git012, you must be a member of the organization 'devtron-labs' to add or remove labels.