Skip to content
OpenAdvisories

Vendor

akuity

6 known vulnerabilities.

Products

kargo 6
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-61850

    Kargo: Privilege escalation via Project RBAC management in the Kargo API

    Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's `Roles` or `Service…

    akuity kargo
  • Critical 9.4
    CVE-2026-27112

    Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

    Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted …

    akuity kargo github.com/akuity/kargo Go