Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-61850 (GCVE-0-2026-61850)

Vulnerability from cvelistv5 – Published: 2026-10-30 19:33 – Updated: 2026-11-05 02:34

Title

Kargo: Privilege escalation via Project RBAC management in the Kargo API

Summary

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's `Roles` or `ServiceAccounts` confer permissions exceeding the user's own. A user authorized to edit `Roles` can create, replace, or add rules granting permissions not held by the user; a user authorized to edit a Role's ServiceAccount can bind an identity, including the user's own, to a more powerful Role. A Kargo Role comprises a `ServiceAccount, Role, and RoleBinding` in the Project namespace. Changes are written using the API server's broadly privileged credentials after only a coarse resource-kind edit check, rather than checking each permission being conferred. This permits escalation to Project-administrator access, disclosure of `Project Secrets` and credentials, and modification or deletion of Project resources. Stolen Git, container-registry, or Helm-registry credentials can extend confidentiality and integrity impacts to those external systems. Escalation remains limited to Projects where the attacker already has RBAC-management delegation and does not itself grant cluster-wide or cross-Project access. Default non-administrator roles do not permit these operations; exploitation requires an `administrator-created custom role` granting the relevant permissions and control of an account assigned that role. This issue is fixed in versions 1.8.14, 1.9.9, and 1.10.8.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 02:34 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

GitHub_M CNA

References

9 references

URL	Tags
https://github.com/akuity/kargo/security/advisori…	x_refsource_CONFIRM
https://github.com/akuity/kargo/commit/1963967881…	x_refsource_MISC
https://github.com/akuity/kargo/commit/50d29c1015…	x_refsource_MISC
https://github.com/akuity/kargo/commit/5ab7c4216a…	x_refsource_MISC
https://github.com/akuity/kargo/commit/72fadd3600…	x_refsource_MISC
https://github.com/akuity/kargo/releases/tag/v1.10.8	x_refsource_MISC
https://github.com/akuity/kargo/releases/tag/v1.1…	x_refsource_MISC
https://github.com/akuity/kargo/releases/tag/v1.8.14	x_refsource_MISC
https://github.com/akuity/kargo/releases/tag/v1.9.9	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
akuity	kargo	Affected: >= 0.6.0, < 1.8.14 Affected: >= 1.9.0-rc.1, < 1.9.9 Affected: >= 1.10.0-rc.1, < 1.10.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61850",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T02:34:09.151728Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T02:34:18.769Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kargo",
          "vendor": "akuity",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.6.0, \u003c 1.8.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0-rc.1, \u003c 1.9.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0-rc.1, \u003c 1.10.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project\u0027s `Roles` or `ServiceAccounts` confer permissions exceeding the user\u0027s own. A user authorized to edit `Roles` can create, replace, or add rules granting permissions not held by the user; a user authorized to edit a Role\u0027s ServiceAccount can bind an identity, including the user\u0027s own, to a more powerful Role. A Kargo Role comprises a `ServiceAccount, Role, and RoleBinding` in the Project namespace. Changes are written using the API server\u0027s broadly privileged credentials after only a coarse resource-kind edit check, rather than checking each permission being conferred. This permits escalation to Project-administrator access, disclosure of `Project Secrets` and credentials, and modification or deletion of Project resources. Stolen Git, container-registry, or Helm-registry credentials can extend confidentiality and integrity impacts to those external systems. Escalation remains limited to Projects where the attacker already has RBAC-management delegation and does not itself grant cluster-wide or cross-Project access. Default non-administrator roles do not permit these operations; exploitation requires an `administrator-created custom role` granting the relevant permissions and control of an account assigned that role. This issue is fixed in versions 1.8.14, 1.9.9, and 1.10.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T19:33:01.720Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/akuity/kargo/security/advisories/GHSA-wp4p-hr79-q4g8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/akuity/kargo/security/advisories/GHSA-wp4p-hr79-q4g8"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/19639678811b486bddb014dabb25397771f3941e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/19639678811b486bddb014dabb25397771f3941e"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/50d29c10153965114f903645c83eadbe7bf58d3f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/50d29c10153965114f903645c83eadbe7bf58d3f"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/5ab7c4216a4151f55ea8ef9ff3b9f884dd322578",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/5ab7c4216a4151f55ea8ef9ff3b9f884dd322578"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/72fadd3600b35e6dce67042eb686720a48b45fa3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/72fadd3600b35e6dce67042eb686720a48b45fa3"
        },
        {
          "name": "https://github.com/akuity/kargo/releases/tag/v1.10.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/releases/tag/v1.10.8"
        },
        {
          "name": "https://github.com/akuity/kargo/releases/tag/v1.11.0-rc.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/releases/tag/v1.11.0-rc.1"
        },
        {
          "name": "https://github.com/akuity/kargo/releases/tag/v1.8.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/releases/tag/v1.8.14"
        },
        {
          "name": "https://github.com/akuity/kargo/releases/tag/v1.9.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/releases/tag/v1.9.9"
        }
      ],
      "source": {
        "advisory": "GHSA-wp4p-hr79-q4g8",
        "discovery": "UNKNOWN"
      },
      "title": "Kargo: Privilege escalation via Project RBAC management in the Kargo API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61850",
    "datePublished": "2026-10-30T19:33:01.720Z",
    "dateReserved": "2026-07-10T20:28:17.513Z",
    "dateUpdated": "2026-11-05T02:34:18.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42350 (GCVE-0-2026-42350)

Vulnerability from cvelistv5 – Published: 2026-05-08 22:35 – Updated: 2026-05-12 18:31

Title

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-12 13:05 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA

References

1 reference

URL	Tags
https://github.com/akuity/kargo/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
akuity	kargo	Affected: < 1.7.10 Affected: >= 1.8.0-rc.1, < 1.8.13 Affected: >= 1.9.0-rc.1, < 1.9.8 Affected: >= 1.10.0-rc.1, < 1.10.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42350",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T13:05:45.823546Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T18:31:37.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kargo",
          "vendor": "akuity",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-rc.1, \u003c 1.8.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0-rc.1, \u003c 1.9.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0-rc.1, \u003c 1.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T22:35:30.155Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf"
        }
      ],
      "source": {
        "advisory": "GHSA-g7gw-m874-7rmf",
        "discovery": "UNKNOWN"
      },
      "title": "Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42350",
    "datePublished": "2026-05-08T22:35:30.155Z",
    "dateReserved": "2026-04-26T13:26:14.515Z",
    "dateUpdated": "2026-05-12T18:31:37.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32828 (GCVE-0-2026-32828)

Vulnerability from cvelistv5 – Published: 2026-03-20 00:39 – Updated: 2026-03-25 14:38

Title

Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration

Summary

Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery (SSRF) against link-local addresses, most critically the cloud instance metadata endpoint (169.254.169.254), enabling exfiltration of sensitive data such as IAM credentials. These steps provide full control over request headers and methods, rendering cloud provider header-based SSRF mitigations ineffective. An authenticated attacker with permissions to create/update Stages or craft Promotion resources can exploit this by submitting a malicious Promotion manifest, with response data retrievable via Promotion status fields, Git repositories, or a second http step. This issue has been fixed in versions 1.6.4, 1.7.9, 1.8.12 and 1.9.5.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-25 14:36 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA

References

2 references

URL	Tags
https://github.com/akuity/kargo/security/advisori…	x_refsource_CONFIRM
https://github.com/akuity/kargo/commit/fd25620c24…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
akuity	kargo	Affected: >= 1.4.0, < 1.6.4 Affected: >= 1.7.0-rc.1, < 1.7.9 Affected: >= 1.8.0-rc.1, < 1.8.12 Affected: >= 1.9.0-rc.1, < 1.9.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32828",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T14:36:34.425459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T14:38:54.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kargo",
          "vendor": "akuity",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.4.0, \u003c 1.6.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0-rc.1, \u003c 1.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-rc.1, \u003c 1.8.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0-rc.1, \u003c 1.9.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery (SSRF) against link-local addresses, most critically the cloud instance metadata endpoint (169.254.169.254), enabling exfiltration of sensitive data such as IAM credentials. These steps provide full control over request headers and methods, rendering cloud provider header-based SSRF mitigations ineffective. An authenticated attacker with permissions to create/update Stages or craft Promotion resources can exploit this by submitting a malicious Promotion manifest, with response data retrievable via Promotion status fields, Git repositories, or a second http step. This issue has been fixed in versions 1.6.4, 1.7.9, 1.8.12 and 1.9.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T00:39:25.548Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/akuity/kargo/security/advisories/GHSA-j94x-8wcp-x7hm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/akuity/kargo/security/advisories/GHSA-j94x-8wcp-x7hm"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/fd25620c2473ed19bec4be4d0f181287ef0f0391",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/fd25620c2473ed19bec4be4d0f181287ef0f0391"
        }
      ],
      "source": {
        "advisory": "GHSA-j94x-8wcp-x7hm",
        "discovery": "UNKNOWN"
      },
      "title": "Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32828",
    "datePublished": "2026-03-20T00:39:25.548Z",
    "dateReserved": "2026-03-16T17:35:36.698Z",
    "dateUpdated": "2026-03-25T14:38:54.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27112 (GCVE-0-2026-27112)

Vulnerability from cvelistv5 – Published: 2026-02-20 21:22 – Updated: 2026-02-24 18:43

Title

Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

Summary

Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in the logic of both endpoints to inject arbitrary resources (of specific types only) into the underlying namespace of an existing Project using the API server's own permissions when that behavior was not intended. Critically, an attacker may exploit this as a vector for elevating their own permissions, which can then be leveraged to achieve remote code execution or secret exfiltration. Exfiltrated artifact repository credentials can be leveraged, in turn, to execute further attacks. In some configurations of the Kargo control plane's underlying Kubernetes cluster, elevated permissions may additionally be leveraged to achieve remote code execution or secret exfiltration using kubectl. This can reduce the complexity of the attack, however, worst case scenarios remain entirely achievable even without this. This vulnerability is fixed in v1.7.8, v1.8.11, and v1.9.3.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-24 18:43 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA

References

2 references

URL	Tags
https://github.com/akuity/kargo/security/advisori…	x_refsource_CONFIRM
https://github.com/akuity/kargo/commit/155c6852ff…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
akuity	kargo	Affected: >= 1.9.0-rc.1, < 1.9.3 Affected: >= 1.8.0-rc.1, < 1.8.11 Affected: >= 1.7.0, < 1.7.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27112",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-24T18:43:26.135548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-24T18:43:40.423Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kargo",
          "vendor": "akuity",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.9.0-rc.1, \u003c 1.9.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-rc.1, \u003c 1.8.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo\u0027s legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in the logic of both endpoints to inject arbitrary resources (of specific types only) into the underlying namespace of an existing Project using the API server\u0027s own permissions when that behavior was not intended. Critically, an attacker may exploit this as a vector for elevating their own permissions, which can then be leveraged to achieve remote code execution or secret exfiltration. Exfiltrated artifact repository credentials can be leveraged, in turn, to execute further attacks. In some configurations of the Kargo control plane\u0027s underlying Kubernetes cluster, elevated permissions may additionally be leveraged to achieve remote code execution or secret exfiltration using kubectl. This can reduce the complexity of the attack, however, worst case scenarios remain entirely achievable even without this. This vulnerability is fixed in v1.7.8, v1.8.11, and v1.9.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-20T21:22:56.719Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/akuity/kargo/security/advisories/GHSA-7g9x-cp9g-92mr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/akuity/kargo/security/advisories/GHSA-7g9x-cp9g-92mr"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/155c6852ffbffa2902f18e6c7add91a846e8d344",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/155c6852ffbffa2902f18e6c7add91a846e8d344"
        }
      ],
      "source": {
        "advisory": "GHSA-7g9x-cp9g-92mr",
        "discovery": "UNKNOWN"
      },
      "title": "Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27112",
    "datePublished": "2026-02-20T21:22:56.719Z",
    "dateReserved": "2026-02-17T18:42:27.042Z",
    "dateUpdated": "2026-02-24T18:43:40.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27111 (GCVE-0-2026-27111)

Vulnerability from cvelistv5 – Published: 2026-02-20 21:17 – Updated: 2026-02-24 18:46

Title

Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints

Summary

Kargo manages and automates the promotion of software artifacts. From v1.9.0 to v1.9.2, Kargo's authorization model includes a promote verb -- a non-standard Kubernetes "dolphin verb" -- that gates the ability to advance Freight through a promotion pipeline. This verb exists to separate the ability to manage promotion-related resources from the ability to trigger promotions, enabling fine-grained access control over what is often a sensitive operation. The promote verb is correctly enforced in Kargo's legacy gRPC API. However, three endpoints in the newer REST API omit this check, relying only on standard Kubernetes RBAC for the underlying resource operations (patch on freights/status or create on promotions). This permits users who hold those standard permissions -- but who were deliberately not granted promote -- to bypass the intended authorization boundary. The affected endpoints are /v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream. This vulnerability is fixed in v1.9.3.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-24 18:44 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA

References

2 references

URL	Tags
https://github.com/akuity/kargo/security/advisori…	x_refsource_CONFIRM
https://github.com/akuity/kargo/commit/833314cad5…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
akuity	kargo	Affected: >= 1.9.0, < 1.9.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27111",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-24T18:44:58.330473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-24T18:46:03.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kargo",
          "vendor": "akuity",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.9.0, \u003c 1.9.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kargo manages and automates the promotion of software artifacts. From v1.9.0 to v1.9.2, Kargo\u0027s authorization model includes a promote verb -- a non-standard Kubernetes \"dolphin verb\" -- that gates the ability to advance Freight through a promotion pipeline. This verb exists to separate the ability to manage promotion-related resources from the ability to trigger promotions, enabling fine-grained access control over what is often a sensitive operation. The promote verb is correctly enforced in Kargo\u0027s legacy gRPC API. However, three endpoints in the newer REST API omit this check, relying only on standard Kubernetes RBAC for the underlying resource operations (patch on freights/status or create on promotions). This permits users who hold those standard permissions -- but who were deliberately not granted promote -- to bypass the intended authorization boundary. The affected endpoints are /v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream. This vulnerability is fixed in v1.9.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-20T21:17:07.383Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/akuity/kargo/security/advisories/GHSA-5vvm-67pj-72g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/akuity/kargo/security/advisories/GHSA-5vvm-67pj-72g4"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/833314cad5513d48d89431493325ae44c1324a49",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/833314cad5513d48d89431493325ae44c1324a49"
        }
      ],
      "source": {
        "advisory": "GHSA-5vvm-67pj-72g4",
        "discovery": "UNKNOWN"
      },
      "title": "Kargo has Missing Authorization Vulnerabilities in Approval \u0026 Promotion REST API Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27111",
    "datePublished": "2026-02-20T21:17:07.383Z",
    "dateReserved": "2026-02-17T18:42:27.042Z",
    "dateUpdated": "2026-02-24T18:46:03.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24748 (GCVE-0-2026-24748)

Vulnerability from cvelistv5 – Published: 2026-01-27 21:23 – Updated: 2026-01-28 21:15

Title

Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access

Summary

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-empty `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-28 21:15 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/akuity/kargo/security/advisori…	x_refsource_CONFIRM
https://github.com/akuity/kargo/commit/23646eaefb…	x_refsource_MISC
https://github.com/akuity/kargo/commit/aa28f81ac1…	x_refsource_MISC
https://github.com/akuity/kargo/commit/b3297ace0d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
akuity	kargo	Affected: < 1.6.3 Affected: >= 1.7.0, < 1.7.7 Affected: <= 1.8.0, < 1.8.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-28T21:15:08.264236Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-28T21:15:14.453Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kargo",
          "vendor": "akuity",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.7"
            },
            {
              "status": "affected",
              "version": "\u003c= 1.8.0, \u003c 1.8.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-empty `Bearer` token value, regardless of validity.  This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T21:23:53.890Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7"
        },
        {
          "name": "https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c"
        }
      ],
      "source": {
        "advisory": "GHSA-w5wv-wvrp-v5m5",
        "discovery": "UNKNOWN"
      },
      "title": "Kargo\u0027s `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24748",
    "datePublished": "2026-01-27T21:23:53.890Z",
    "dateReserved": "2026-01-26T19:06:16.060Z",
    "dateUpdated": "2026-01-28T21:15:14.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities by akuity

CVE-2026-61850 (GCVE-0-2026-61850)

CVE-2026-42350 (GCVE-0-2026-42350)

CVE-2026-32828 (GCVE-0-2026-32828)

CVE-2026-27112 (GCVE-0-2026-27112)

CVE-2026-27111 (GCVE-0-2026-27111)

CVE-2026-24748 (GCVE-0-2026-24748)