CVE-2026-42350

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf

Configurations

No configuration.

History

24 Jul 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Kargo gestiona y automatiza la promoción de artefactos de software. Antes de las versiones 1.7.10, 1.8.13, 1.9.8 y 1.10.2, Kargo es vulnerable a una redirección abierta en el flujo de inicio de sesión OIDC de la interfaz de usuario a través del parámetro de consulta redirectTo. Este problema ha sido parcheado en las versiones 1.7.10, 1.8.13, 1.9.8 y 1.10.2.

08 May 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-08 23:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-42350

Mitre link : CVE-2026-42350

CVE.ORG link : CVE-2026-42350

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-42350", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42350", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:05:45.823546Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "akuity", "product": "kargo", "versions": [{"status": "affected", "version": "< 1.7.10"}, {"status": "affected", "version": ">= 1.8.0-rc.1, < 1.8.13"}, {"status": "affected", "version": ">= 1.9.0-rc.1, < 1.9.8"}, {"status": "affected", "version": ">= 1.10.0-rc.1, < 1.10.2"}]}]}], "published": "2026-05-08T23:16:38.040", "references": [{"url": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2."}, {"lang": "es", "value": "Kargo gestiona y automatiza la promoci\u00f3n de artefactos de software. Antes de las versiones 1.7.10, 1.8.13, 1.9.8 y 1.10.2, Kargo es vulnerable a una redirecci\u00f3n abierta en el flujo de inicio de sesi\u00f3n OIDC de la interfaz de usuario a trav\u00e9s del par\u00e1metro de consulta redirectTo. Este problema ha sido parcheado en las versiones 1.7.10, 1.8.13, 1.9.8 y 1.10.2."}], "lastModified": "2026-07-24T21:10:00.143", "sourceIdentifier": "security-advisories@github.com"}