What’s Vulnerable › Products

akuity kargo vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your akuity kargo version is affected

Latest akuity kargo vulnerabilities

• CVE-2026-61850 — Kargo: Privilege escalation via Project RBAC management in the Kargo API (CVSS 9.3)
• CVE-2026-42350 — Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter (CVSS 5.1)
• CVE-2026-32828 — Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration (CVSS 4.9)
• CVE-2026-27112 — Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints (CVSS 9.9)
• CVE-2026-27111 — Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints (CVSS 5.0)
• CVE-2026-24748 — Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access (CVSS 7.2)