Login Request a demo
KA
Product
kargo
by akuity · last CVE May 8, 2026
5
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 1High 1Medium 3Low 0
Severity
All severities5Critical1High1Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add kargo to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-27112
9.9
0%
Feb 20
Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints
Affected: >= 1.9.0-rc.1, < 1.9.3; >= 1.8.0-rc.1, < 1.8.11; >= 1.7.0, < 1.7.8
CVE-2026-24748
7.2
0%
Jan 27
Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access
Affected: < 1.6.3; >= 1.7.0, < 1.7.7; <= 1.8.0, < 1.8.7
CVE-2026-42350
5.1
0%
May 8
Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Affected: < 1.7.10; >= 1.8.0-rc.1, < 1.8.13; >= 1.9.0-rc.1, < 1.9.8; >= 1.10.0-rc.1, < 1.10.2
CVE-2026-27111
5.0
0%
Feb 20
Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints
Affected: >= 1.9.0, < 1.9.3
CVE-2026-32828
4.9
0%
Mar 20
Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
Affected: >= 1.4.0, < 1.6.4; >= 1.7.0-rc.1, < 1.7.9; >= 1.8.0-rc.1, < 1.8.12; >= 1.9.0-rc.1, < 1.9.5
Showing 5