Every CVE Search/ Get API key

CVE-2026-42350

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

5.1 MediumFix available

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.31%Up 0.3 points since May 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Record
CVE-2026-42350
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Weakness
CWE-601
Updated
2026-11-02
EUVDEUVD-2026-28857 5.1

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Record
EUVD-2026-28857
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-g7gw-m874-7rmf 1.2

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary

The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's own origin. Protocol-relative values (e.g. //attacker.example.com) and values using a backslash prefix (e.g. /\attacker.example.com) are accepted and result in navigation to an external origin.

An attacker can exploit this by crafting a URL of the form https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\attacker.example.com and delivering it to a victim through any channel that permits link sharing. When the victim follows the link and signs in to Kargo, the browser is redirected to the attacker-controlled origin. Because the initial URL resolves to the legitimate Kargo host and the user is genuinely authenticated in the process, the redirect inherits the perceived trust of the user's own Kargo instance.

The principal risk is that such a redirect can serve as a stepping stone for credentials phishing. The attacker-controlled page can present a UI resembling Kargo or an associated identity provider and solicit credentials from the user. The vulnerability does not, by itself, expose any data from Kargo or permit modification of Kargo resources, and it does not affect authentication when Kargo's built-in admin credentials are used.

Base Metrics

The following sections provide the rationale for the values selected for each of CVSS v4's base metrics. The resulting vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N, which scores 0.0 (None). This reflects a known limitation of CVSS v4: the standard scopes impact to direct consequences of exploitation, and so does not capture vulnerabilities whose operational significance lies in enabling multi-step attacks. The open redirect here fits that pattern — its immediate effect is benign navigation, and any meaningful harm depends on additional attacker-controlled infrastructure and voluntary actions by the victim. Kargo classifies this vulnerability's severity as Low on a qualitative basis, reflecting the real but bounded operational risk that open redirects pose.

Attack Vector (AV): Network

The Kargo UI is served by the Kargo API server over HTTP/HTTPS. No local, adjacent network, or physical access is required.

Attack Complexity (AC): Low

Exploitation requires only a crafted URL. No race conditions, non-default configurations, or prior information gathering are required.

Attack Requirements (AT): None

No specific environmental conditions are required beyond a Kargo deployment configured for OIDC authentication, which is the expected configuration for any non-development deployment.

Privileges Required (PR): None

The attacker does not need to authenticate to Kargo or hold any permissions. The victim's own authentication completes the redirect.

User Interaction (UI): Active

Exploitation requires a victim to follow the crafted link and then complete the OIDC sign-in flow. Absent this interaction, no redirect occurs.

Confidentiality Impact to Vulnerable System (VC): None

The vulnerability does not expose any data from the Kargo control plane.

Integrity Impact to Vulnerable System (VI): None

The vulnerability does not permit modification of any data or configuration within Kargo.

Availability Impact to Vulnerable System (VA): None

The vulnerability does not provide any mechanism for denial of service against Kargo.

Confidentiality Impact to Subsequent Systems (SC): None

The direct consequence of exploitation is navigation to an attacker-controlled URL. Any resulting compromise of the victim's credentials or other data requires the attacker to stage a convincing phishing page and the victim to voluntarily submit information to it — neither action is performed by the exploit itself.…

Record
GHSA-g7gw-m874-7rmf
CVSS 4.0
1.2 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
Weakness
CWE-601
Updated
2026-11-02
NVD 5.1

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Record
CVE-2026-42350
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-601
Updated
2026-11-02
OSV 5.1

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Record
CVE-2026-42350
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Weakness
CWE-601
Updated
2026-11-02
OSVGHSA-g7gw-m874-7rmf 1.2

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary

The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's own origin. Protocol-relative values (e.g. //attacker.example.com) and values using a backslash prefix (e.g. /\attacker.example.com) are accepted and result in navigation to an external origin.

An attacker can exploit this by crafting a URL of the form https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\attacker.example.com and delivering it to a victim through any channel that permits link sharing. When the victim follows the link and signs in to Kargo, the browser is redirected to the attacker-controlled origin. Because the initial URL resolves to the legitimate Kargo host and the user is genuinely authenticated in the process, the redirect inherits the perceived trust of the user's own Kargo instance.

The principal risk is that such a redirect can serve as a stepping stone for credentials phishing. The attacker-controlled page can present a UI resembling Kargo or an associated identity provider and solicit credentials from the user. The vulnerability does not, by itself, expose any data from Kargo or permit modification of Kargo resources, and it does not affect authentication when Kargo's built-in admin credentials are used.

Base Metrics

The following sections provide the rationale for the values selected for each of CVSS v4's base metrics. The resulting vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N, which scores 0.0 (None). This reflects a known limitation of CVSS v4: the standard scopes impact to direct consequences of exploitation, and so does not capture vulnerabilities whose operational significance lies in enabling multi-step attacks. The open redirect here fits that pattern — its immediate effect is benign navigation, and any meaningful harm depends on additional attacker-controlled infrastructure and voluntary actions by the victim. Kargo classifies this vulnerability's severity as Low on a qualitative basis, reflecting the real but bounded operational risk that open redirects pose.

Attack Vector (AV): Network

The Kargo UI is served by the Kargo API server over HTTP/HTTPS. No local, adjacent network, or physical access is required.

Attack Complexity (AC): Low

Exploitation requires only a crafted URL. No race conditions, non-default configurations, or prior information gathering are required.

Attack Requirements (AT): None

No specific environmental conditions are required beyond a Kargo deployment configured for OIDC authentication, which is the expected configuration for any non-development deployment.

Privileges Required (PR): None

The attacker does not need to authenticate to Kargo or hold any permissions. The victim's own authentication completes the redirect.

User Interaction (UI): Active

Exploitation requires a victim to follow the crafted link and then complete the OIDC sign-in flow. Absent this interaction, no redirect occurs.

Confidentiality Impact to Vulnerable System (VC): None

The vulnerability does not expose any data from the Kargo control plane.

Integrity Impact to Vulnerable System (VI): None

The vulnerability does not permit modification of any data or configuration within Kargo.

Availability Impact to Vulnerable System (VA): None

The vulnerability does not provide any mechanism for denial of service against Kargo.

Confidentiality Impact to Subsequent Systems (SC): None

The direct consequence of exploitation is navigation to an attacker-controlled URL. Any resulting compromise of the victim's credentials or other data requires the attacker to stage a convincing phishing page and the victim to voluntarily submit information to it — neither action is performed by the exploit itself.…

Record
GHSA-g7gw-m874-7rmf
CVSS 4.0
1.2 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
Weakness
CWE-601
Updated
2026-11-02
OSVGO-2026-6301 No score

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo

Record
GO-2026-6301
Updated
2026-11-02
OSVopenSUSE-SU-2026:21761-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
openSUSE-SU-2026:21761-1
Updated
2026-11-02
OSVSUSE-SU-2026:23625-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
SUSE-SU-2026:23625-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/akuity/kargo
Go
 before 1.7.10
1.7.10
github.com/akuity/kargo
Go
 1.8.0 up to 1.8.13
1.8.13
github.com/akuity/kargo
Go
 1.9.0 up to 1.9.8
1.9.8
github.com/akuity/kargo
Go
 1.10.0 up to 1.10.2
1.10.2
github.com/akuity/kargo
Go
 before 1.7.10, 1.8.0 up to 1.8.13, 1.9.0 up to 1.9.8, 1.10.0 up to 1.10.2
1.7.101.8.131.9.81.10.2
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42350 is a medium vulnerability (CVSS 5.1) in Akuity Kargo, published May 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in github.com/akuity/kargo 1.7.10.

References

Show 190 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open