{"id":"CVE-2026-107589","title":"Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.","summary":"Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L","cwe":["CWE-290"],"vendor":"Jacamar CI","product":"Jacamar CI","affected":["jacamar_ci < 0.30.0"],"published":"2026-10-08","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:02:43.860","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107589","references":[{"url":"https://ecp-ci.gitlab.io/docs/releasenotes/jacamar/jacamar_0.30.0.html","label":"cve@gitlab.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-08T15:49:37.991Z","slug":"CVE-2026-107589","body":"## Overview\n\nInsufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}