What’s Vulnerable › Vulnerabilities
CVE-2026-42350: Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
- Severity: medium (CVSS 5.1 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-08 · updated 2026-07-24
- Weakness: CWE-601
Description
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
Affected products
- akuity kargo: before 1.7.10; from 1.8.0-rc.1, < 1.8.13; from 1.9.0-rc.1, < 1.9.8; from 1.10.0-rc.1, < 1.10.2
References
Get alerted when CVE-2026-42350 or the next vulnerability affects your stack