github.com/akuity/kargo vulnerabilities (Go)

5 vulnerabilities.

• github.com/akuity/kargo Go Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter CVE-2026-42350 Fix available 5.1 MediumMay 8, 2026
• github.com/akuity/kargo Go Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration CVE-2026-32828 Fix available 5.1 MediumMarch 16, 2026
• github.com/akuity/kargo Go Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints CVE-2026-27112 Fix available 9.4 CriticalFebruary 19, 2026
• github.com/akuity/kargo Go Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints CVE-2026-27111 Fix available 5.3 MediumFebruary 19, 2026
• github.com/akuity/kargo Go Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access CVE-2026-24748 Fix available 6.9 MediumJanuary 27, 2026