Vulnerability-Lookup

CVE-2026-42350 (GCVE-0-2026-42350)

Vulnerability from cvelistv5 – Published: 2026-05-08 22:35 – Updated: 2026-05-12 18:31

Title

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-12 13:05 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7639 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/akuity/kargo/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
akuity	kargo	Affected: < 1.7.10 Affected: >= 1.8.0-rc.1, < 1.8.13 Affected: >= 1.9.0-rc.1, < 1.9.8 Affected: >= 1.10.0-rc.1, < 1.10.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42350",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T13:05:45.823546Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T18:31:37.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kargo",
          "vendor": "akuity",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-rc.1, \u003c 1.8.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0-rc.1, \u003c 1.9.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0-rc.1, \u003c 1.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T22:35:30.155Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf"
        }
      ],
      "source": {
        "advisory": "GHSA-g7gw-m874-7rmf",
        "discovery": "UNKNOWN"
      },
      "title": "Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42350",
    "datePublished": "2026-05-08T22:35:30.155Z",
    "dateReserved": "2026-04-26T13:26:14.515Z",
    "dateUpdated": "2026-05-12T18:31:37.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42350",
      "date": "2026-10-21",
      "epss": "0.00406",
      "percentile": "0.33646"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "kargo",
                "vendor": "akuity",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.7.10"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.8.0-rc.1, \u003c 1.8.13"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.9.0-rc.1, \u003c 1.9.8"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.10.0-rc.1, \u003c 1.10.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2."
          },
          {
            "lang": "es",
            "value": "Kargo gestiona y automatiza la promoci\u00f3n de artefactos de software. Antes de las versiones 1.7.10, 1.8.13, 1.9.8 y 1.10.2, Kargo es vulnerable a una redirecci\u00f3n abierta en el flujo de inicio de sesi\u00f3n OIDC de la interfaz de usuario a trav\u00e9s del par\u00e1metro de consulta redirectTo. Este problema ha sido parcheado en las versiones 1.7.10, 1.8.13, 1.9.8 y 1.10.2."
          }
        ],
        "id": "CVE-2026-42350",
        "lastModified": "2026-07-24T21:10:00.143",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-42350",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T13:05:45.823546Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-08T23:16:38.040",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-601"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-12T20:21:17+00:00",
      "cve": "CVE-2026-42350",
      "id": "CVE-2026-42350",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42350.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-42350",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-12T13:05:45.823546Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-12T13:06:04.088Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "kargo",
              "vendor": "akuity",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.7.10"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.8.0-rc.1, \u003c 1.8.13"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.9.0-rc.1, \u003c 1.9.8"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.10.0-rc.1, \u003c 1.10.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-601",
                  "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-08T22:35:30.155Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf"
            }
          ],
          "source": {
            "advisory": "GHSA-g7gw-m874-7rmf",
            "discovery": "UNKNOWN"
          },
          "title": "Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-42350",
        "datePublished": "2026-05-08T22:35:30.155Z",
        "dateReserved": "2026-04-26T13:26:14.515Z",
        "dateUpdated": "2026-05-12T18:31:37.913Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42350

Vulnerability from fkie_nvd - Published: 2026-05-08 23:16 - Updated: 2026-07-24 21:10

Severity

5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kargo",
          "vendor": "akuity",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-rc.1, \u003c 1.8.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0-rc.1, \u003c 1.9.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0-rc.1, \u003c 1.10.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2."
    },
    {
      "lang": "es",
      "value": "Kargo gestiona y automatiza la promoci\u00f3n de artefactos de software. Antes de las versiones 1.7.10, 1.8.13, 1.9.8 y 1.10.2, Kargo es vulnerable a una redirecci\u00f3n abierta en el flujo de inicio de sesi\u00f3n OIDC de la interfaz de usuario a trav\u00e9s del par\u00e1metro de consulta redirectTo. Este problema ha sido parcheado en las versiones 1.7.10, 1.8.13, 1.9.8 y 1.10.2."
    }
  ],
  "id": "CVE-2026-42350",
  "lastModified": "2026-07-24T21:10:00.143",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42350",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-12T13:05:45.823546Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-08T23:16:38.040",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-G7GW-M874-7RMF

Vulnerability from github – Published: 2026-08-27 17:17 – Updated: 2026-08-27 17:17

Summary

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Details

Summary

The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's own origin. Protocol-relative values (e.g. //attacker.example.com) and values using a backslash prefix (e.g. /\attacker.example.com) are accepted and result in navigation to an external origin.

An attacker can exploit this by crafting a URL of the form https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\attacker.example.com and delivering it to a victim through any channel that permits link sharing. When the victim follows the link and signs in to Kargo, the browser is redirected to the attacker-controlled origin. Because the initial URL resolves to the legitimate Kargo host and the user is genuinely authenticated in the process, the redirect inherits the perceived trust of the user's own Kargo instance.

The principal risk is that such a redirect can serve as a stepping stone for credentials phishing. The attacker-controlled page can present a UI resembling Kargo or an associated identity provider and solicit credentials from the user. The vulnerability does not, by itself, expose any data from Kargo or permit modification of Kargo resources, and it does not affect authentication when Kargo's built-in admin credentials are used.

Base Metrics

The following sections provide the rationale for the values selected for each of CVSS v4's base metrics. The resulting vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N, which scores 0.0 (None). This reflects a known limitation of CVSS v4: the standard scopes impact to direct consequences of exploitation, and so does not capture vulnerabilities whose operational significance lies in enabling multi-step attacks. The open redirect here fits that pattern — its immediate effect is benign navigation, and any meaningful harm depends on additional attacker-controlled infrastructure and voluntary actions by the victim. Kargo classifies this vulnerability's severity as Low on a qualitative basis, reflecting the real but bounded operational risk that open redirects pose.

Attack Vector (AV): Network

The Kargo UI is served by the Kargo API server over HTTP/HTTPS. No local, adjacent network, or physical access is required.

Attack Complexity (AC): Low

Exploitation requires only a crafted URL. No race conditions, non-default configurations, or prior information gathering are required.

Attack Requirements (AT): None

No specific environmental conditions are required beyond a Kargo deployment configured for OIDC authentication, which is the expected configuration for any non-development deployment.

Privileges Required (PR): None

The attacker does not need to authenticate to Kargo or hold any permissions. The victim's own authentication completes the redirect.

User Interaction (UI): Active

Exploitation requires a victim to follow the crafted link and then complete the OIDC sign-in flow. Absent this interaction, no redirect occurs.

Confidentiality Impact to Vulnerable System (VC): None

The vulnerability does not expose any data from the Kargo control plane.

Integrity Impact to Vulnerable System (VI): None

The vulnerability does not permit modification of any data or configuration within Kargo.

Availability Impact to Vulnerable System (VA): None

The vulnerability does not provide any mechanism for denial of service against Kargo.

Confidentiality Impact to Subsequent Systems (SC): None

The direct consequence of exploitation is navigation to an attacker-controlled URL. Any resulting compromise of the victim's credentials or other data requires the attacker to stage a convincing phishing page and the victim to voluntarily submit information to it — neither action is performed by the exploit itself. CVSS v4 scopes impact to direct consequences of exploitation, so the enabled phishing scenario is not reflected here.

Integrity Impact to Subsequent Systems (SI): None

The vulnerability does not modify any data on downstream systems. Tampering an attacker might perform using credentials phished via the enabled redirect would be a consequence of a follow-on attack, not of this vulnerability.

Availability Impact to Subsequent Systems (SA): None

The vulnerability does not provide any mechanism to degrade the availability of downstream systems.

Mitigating Factors

Exploitation is contingent on social engineering. A victim must both follow the crafted link and complete an authentication flow for the redirect to fire.
The vulnerability does not directly compromise Kargo or expose any Kargo-held data. Impact is limited to enabling an attacker-controlled destination to be reached via a legitimate Kargo URL.
There is no evidence of exploitation in the wild.

Severity

1.2 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.8.0"
            },
            {
              "fixed": "1.8.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.0"
            },
            {
              "fixed": "1.9.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "1.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42350"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T17:17:36Z",
    "nvd_published_at": "2026-05-08T23:16:38Z",
    "severity": "LOW"
  },
  "details": "## Summary\n\nThe Kargo UI reads a `redirectTo` query parameter on the `/login` and `/token-renew` routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI\u0027s own origin. Protocol-relative values (e.g. `//attacker.example.com`) and values using a backslash prefix (e.g. `/\\attacker.example.com`) are accepted and result in navigation to an external origin.\n\nAn attacker can exploit this by crafting a URL of the form `https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\\attacker.example.com` and delivering it to a victim through any channel that permits link sharing. When the victim follows the link and signs in to Kargo, the browser is redirected to the attacker-controlled origin. Because the initial URL resolves to the legitimate Kargo host and the user is genuinely authenticated in the process, the redirect inherits the perceived trust of the user\u0027s own Kargo instance.\n\nThe principal risk is that such a redirect can serve as a stepping stone for credentials phishing. The attacker-controlled page can present a UI resembling Kargo or an associated identity provider and solicit credentials from the user. The vulnerability does not, by itself, expose any data from Kargo or permit modification of Kargo resources, and it does not affect authentication when Kargo\u0027s built-in admin credentials are used.\n\n## Base Metrics\n\nThe following sections provide the rationale for the values selected for each of CVSS v4\u0027s base metrics. The resulting vector is `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N`, which scores 0.0 (None). This reflects a known limitation of CVSS v4: the standard scopes impact to direct consequences of exploitation, and so does not capture vulnerabilities whose operational significance lies in enabling multi-step attacks. The open redirect here fits that pattern \u2014 its immediate effect is benign navigation, and any meaningful harm depends on additional attacker-controlled infrastructure and voluntary actions by the victim. Kargo classifies this vulnerability\u0027s severity as Low on a qualitative basis, reflecting the real but bounded operational risk that open redirects pose.\n\n### Attack Vector (AV): Network\n\nThe Kargo UI is served by the Kargo API server over HTTP/HTTPS. No local, adjacent network, or physical access is required.\n\n### Attack Complexity (AC): Low\n\nExploitation requires only a crafted URL. No race conditions, non-default configurations, or prior information gathering are required.\n\n### Attack Requirements (AT): None\n\nNo specific environmental conditions are required beyond a Kargo deployment configured for OIDC authentication, which is the expected configuration for any non-development deployment.\n\n### Privileges Required (PR): None\n\nThe attacker does not need to authenticate to Kargo or hold any permissions. The victim\u0027s own authentication completes the redirect.\n\n### User Interaction (UI): Active\n\nExploitation requires a victim to follow the crafted link and then complete the OIDC sign-in flow. Absent this interaction, no redirect occurs.\n\n### Confidentiality Impact to Vulnerable System (VC): None\n\nThe vulnerability does not expose any data from the Kargo control plane.\n\n### Integrity Impact to Vulnerable System (VI): None\n\nThe vulnerability does not permit modification of any data or configuration within Kargo.\n\n### Availability Impact to Vulnerable System (VA): None\n\nThe vulnerability does not provide any mechanism for denial of service against Kargo.\n\n### Confidentiality Impact to Subsequent Systems (SC): None\n\nThe direct consequence of exploitation is navigation to an attacker-controlled URL. Any resulting compromise of the victim\u0027s credentials or other data requires the attacker to stage a convincing phishing page and the victim to voluntarily submit information to it \u2014 neither action is performed by the exploit itself. CVSS v4 scopes impact to direct consequences of exploitation, so the enabled phishing scenario is not reflected here.\n\n### Integrity Impact to Subsequent Systems (SI): None\n\nThe vulnerability does not modify any data on downstream systems. Tampering an attacker might perform using credentials phished via the enabled redirect would be a consequence of a follow-on attack, not of this vulnerability.\n\n### Availability Impact to Subsequent Systems (SA): None\n\nThe vulnerability does not provide any mechanism to degrade the availability of downstream systems.\n\n## Mitigating Factors\n\n- Exploitation is contingent on social engineering. A victim must both follow the crafted link and complete an authentication flow for the redirect to fire.\n\n- The vulnerability does not directly compromise Kargo or expose any Kargo-held data. Impact is limited to enabling an attacker-controlled destination to be reached via a legitimate Kargo URL.\n\n- There is no evidence of exploitation in the wild.",
  "id": "GHSA-g7gw-m874-7rmf",
  "modified": "2026-08-27T17:17:37Z",
  "published": "2026-08-27T17:17:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42350"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/0b89215740e93d18f1ab2187f6f9733137f9d00f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/52107be1d392feaf02d640083cc000be5756f557"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/768b2a62dcd70b7b2313290fea6c673e49e0c2d4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/d2c8d185b7cc43e225e0e2d17937511820479834"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/db8ca6c015defc5ea29afb32cdea982b657f263a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/akuity/kargo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/releases/tag/v1.10.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/releases/tag/v1.7.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/releases/tag/v1.8.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/releases/tag/v1.9.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-42350 (GCVE-0-2026-42350)

FKIE_CVE-2026-42350

GHSA-G7GW-M874-7RMF

Summary

Base Metrics

Attack Vector (AV): Network

Attack Complexity (AC): Low

Attack Requirements (AT): None

Privileges Required (PR): None

User Interaction (UI): Active

Confidentiality Impact to Vulnerable System (VC): None

Integrity Impact to Vulnerable System (VI): None

Availability Impact to Vulnerable System (VA): None

Confidentiality Impact to Subsequent Systems (SC): None

Integrity Impact to Subsequent Systems (SI): None

Availability Impact to Subsequent Systems (SA): None

Mitigating Factors

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour