Skip to content
OpenAdvisories

Package · Go

github.com/akuity/kargo

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-42350

    Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

    Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10…

    akuity kargo github.com/akuity/kargo Go
  • Medium 5.1
    CVE-2026-32828

    Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration

    Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery (…

    akuity kargo github.com/akuity/kargo Go
  • Medium 5.3
    CVE-2026-27111

    Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints

    Kargo manages and automates the promotion of software artifacts. From v1.9.0 to v1.9.2, Kargo's authorization model includes a promote verb -- a non-standard Kubernetes "dolphin verb" -- that gates the ability to advance Freight through a promotion pipeline. …

    akuity kargo github.com/akuity/kargo Go
  • Medium 6.9
    CVE-2026-24748

    Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access

    Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying …

    akuity kargo github.com/akuity/kargo Go