All 6 CVE vulnerabilities found in kargo, with AI-generated Chinese analysis, references, and POCs.
Vendor: akuity
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-61850 | Kargo: Privilege escalation via Project RBAC management in the Kargo API CWE-269 | 9.3 | Critical | 2026-10-30 |
| CVE-2026-42350 | Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter CWE-601 | 6.1AI | Medium AI | 2026-05-08 |
| CVE-2026-32828 | Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration CWE-918 | 9.1 | - | 2026-03-20 |
| CVE-2026-27112 | Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints CWE-863 | 8.2AI | High AI | 2026-02-20 |
| CVE-2026-27111 | Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints CWE-862 | 8.1AI | High AI | 2026-02-20 |
| CVE-2026-24748 | Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access CWE-863 | 5.3AI | Medium AI | 2026-01-27 |
All 6 known CVE vulnerabilities affecting kargo with full Chinese analysis, references, and POCs where available.