GHSA-G7GW-M874-7RMF

Vulnerability from github – Published: 2026-08-27 17:17 – Updated: 2026-08-27 17:17
VLAI
Summary
Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Details

Summary

The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's own origin. Protocol-relative values (e.g. //attacker.example.com) and values using a backslash prefix (e.g. /\attacker.example.com) are accepted and result in navigation to an external origin.

An attacker can exploit this by crafting a URL of the form https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\attacker.example.com and delivering it to a victim through any channel that permits link sharing. When the victim follows the link and signs in to Kargo, the browser is redirected to the attacker-controlled origin. Because the initial URL resolves to the legitimate Kargo host and the user is genuinely authenticated in the process, the redirect inherits the perceived trust of the user's own Kargo instance.

The principal risk is that such a redirect can serve as a stepping stone for credentials phishing. The attacker-controlled page can present a UI resembling Kargo or an associated identity provider and solicit credentials from the user. The vulnerability does not, by itself, expose any data from Kargo or permit modification of Kargo resources, and it does not affect authentication when Kargo's built-in admin credentials are used.

Base Metrics

The following sections provide the rationale for the values selected for each of CVSS v4's base metrics. The resulting vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N, which scores 0.0 (None). This reflects a known limitation of CVSS v4: the standard scopes impact to direct consequences of exploitation, and so does not capture vulnerabilities whose operational significance lies in enabling multi-step attacks. The open redirect here fits that pattern — its immediate effect is benign navigation, and any meaningful harm depends on additional attacker-controlled infrastructure and voluntary actions by the victim. Kargo classifies this vulnerability's severity as Low on a qualitative basis, reflecting the real but bounded operational risk that open redirects pose.

Attack Vector (AV): Network

The Kargo UI is served by the Kargo API server over HTTP/HTTPS. No local, adjacent network, or physical access is required.

Attack Complexity (AC): Low

Exploitation requires only a crafted URL. No race conditions, non-default configurations, or prior information gathering are required.

Attack Requirements (AT): None

No specific environmental conditions are required beyond a Kargo deployment configured for OIDC authentication, which is the expected configuration for any non-development deployment.

Privileges Required (PR): None

The attacker does not need to authenticate to Kargo or hold any permissions. The victim's own authentication completes the redirect.

User Interaction (UI): Active

Exploitation requires a victim to follow the crafted link and then complete the OIDC sign-in flow. Absent this interaction, no redirect occurs.

Confidentiality Impact to Vulnerable System (VC): None

The vulnerability does not expose any data from the Kargo control plane.

Integrity Impact to Vulnerable System (VI): None

The vulnerability does not permit modification of any data or configuration within Kargo.

Availability Impact to Vulnerable System (VA): None

The vulnerability does not provide any mechanism for denial of service against Kargo.

Confidentiality Impact to Subsequent Systems (SC): None

The direct consequence of exploitation is navigation to an attacker-controlled URL. Any resulting compromise of the victim's credentials or other data requires the attacker to stage a convincing phishing page and the victim to voluntarily submit information to it — neither action is performed by the exploit itself. CVSS v4 scopes impact to direct consequences of exploitation, so the enabled phishing scenario is not reflected here.

Integrity Impact to Subsequent Systems (SI): None

The vulnerability does not modify any data on downstream systems. Tampering an attacker might perform using credentials phished via the enabled redirect would be a consequence of a follow-on attack, not of this vulnerability.

Availability Impact to Subsequent Systems (SA): None

The vulnerability does not provide any mechanism to degrade the availability of downstream systems.

Mitigating Factors

  • Exploitation is contingent on social engineering. A victim must both follow the crafted link and complete an authentication flow for the redirect to fire.

  • The vulnerability does not directly compromise Kargo or expose any Kargo-held data. Impact is limited to enabling an attacker-controlled destination to be reached via a legitimate Kargo URL.

  • There is no evidence of exploitation in the wild.

Severity
1.2 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.8.0"
            },
            {
              "fixed": "1.8.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.0"
            },
            {
              "fixed": "1.9.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "1.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42350"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T17:17:36Z",
    "nvd_published_at": "2026-05-08T23:16:38Z",
    "severity": "LOW"
  },
  "details": "## Summary\n\nThe Kargo UI reads a `redirectTo` query parameter on the `/login` and `/token-renew` routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI\u0027s own origin. Protocol-relative values (e.g. `//attacker.example.com`) and values using a backslash prefix (e.g. `/\\attacker.example.com`) are accepted and result in navigation to an external origin.\n\nAn attacker can exploit this by crafting a URL of the form `https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\\attacker.example.com` and delivering it to a victim through any channel that permits link sharing. When the victim follows the link and signs in to Kargo, the browser is redirected to the attacker-controlled origin. Because the initial URL resolves to the legitimate Kargo host and the user is genuinely authenticated in the process, the redirect inherits the perceived trust of the user\u0027s own Kargo instance.\n\nThe principal risk is that such a redirect can serve as a stepping stone for credentials phishing. The attacker-controlled page can present a UI resembling Kargo or an associated identity provider and solicit credentials from the user. The vulnerability does not, by itself, expose any data from Kargo or permit modification of Kargo resources, and it does not affect authentication when Kargo\u0027s built-in admin credentials are used.\n\n## Base Metrics\n\nThe following sections provide the rationale for the values selected for each of CVSS v4\u0027s base metrics. The resulting vector is `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N`, which scores 0.0 (None). This reflects a known limitation of CVSS v4: the standard scopes impact to direct consequences of exploitation, and so does not capture vulnerabilities whose operational significance lies in enabling multi-step attacks. The open redirect here fits that pattern \u2014 its immediate effect is benign navigation, and any meaningful harm depends on additional attacker-controlled infrastructure and voluntary actions by the victim. Kargo classifies this vulnerability\u0027s severity as Low on a qualitative basis, reflecting the real but bounded operational risk that open redirects pose.\n\n### Attack Vector (AV): Network\n\nThe Kargo UI is served by the Kargo API server over HTTP/HTTPS. No local, adjacent network, or physical access is required.\n\n### Attack Complexity (AC): Low\n\nExploitation requires only a crafted URL. No race conditions, non-default configurations, or prior information gathering are required.\n\n### Attack Requirements (AT): None\n\nNo specific environmental conditions are required beyond a Kargo deployment configured for OIDC authentication, which is the expected configuration for any non-development deployment.\n\n### Privileges Required (PR): None\n\nThe attacker does not need to authenticate to Kargo or hold any permissions. The victim\u0027s own authentication completes the redirect.\n\n### User Interaction (UI): Active\n\nExploitation requires a victim to follow the crafted link and then complete the OIDC sign-in flow. Absent this interaction, no redirect occurs.\n\n### Confidentiality Impact to Vulnerable System (VC): None\n\nThe vulnerability does not expose any data from the Kargo control plane.\n\n### Integrity Impact to Vulnerable System (VI): None\n\nThe vulnerability does not permit modification of any data or configuration within Kargo.\n\n### Availability Impact to Vulnerable System (VA): None\n\nThe vulnerability does not provide any mechanism for denial of service against Kargo.\n\n### Confidentiality Impact to Subsequent Systems (SC): None\n\nThe direct consequence of exploitation is navigation to an attacker-controlled URL. Any resulting compromise of the victim\u0027s credentials or other data requires the attacker to stage a convincing phishing page and the victim to voluntarily submit information to it \u2014 neither action is performed by the exploit itself. CVSS v4 scopes impact to direct consequences of exploitation, so the enabled phishing scenario is not reflected here.\n\n### Integrity Impact to Subsequent Systems (SI): None\n\nThe vulnerability does not modify any data on downstream systems. Tampering an attacker might perform using credentials phished via the enabled redirect would be a consequence of a follow-on attack, not of this vulnerability.\n\n### Availability Impact to Subsequent Systems (SA): None\n\nThe vulnerability does not provide any mechanism to degrade the availability of downstream systems.\n\n## Mitigating Factors\n\n- Exploitation is contingent on social engineering. A victim must both follow the crafted link and complete an authentication flow for the redirect to fire.\n\n- The vulnerability does not directly compromise Kargo or expose any Kargo-held data. Impact is limited to enabling an attacker-controlled destination to be reached via a legitimate Kargo URL.\n\n- There is no evidence of exploitation in the wild.",
  "id": "GHSA-g7gw-m874-7rmf",
  "modified": "2026-08-27T17:17:37Z",
  "published": "2026-08-27T17:17:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42350"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/0b89215740e93d18f1ab2187f6f9733137f9d00f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/52107be1d392feaf02d640083cc000be5756f557"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/768b2a62dcd70b7b2313290fea6c673e49e0c2d4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/d2c8d185b7cc43e225e0e2d17937511820479834"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/db8ca6c015defc5ea29afb32cdea982b657f263a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/akuity/kargo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/releases/tag/v1.10.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/releases/tag/v1.7.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/releases/tag/v1.8.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/releases/tag/v1.9.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.