Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-42350

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

akuity kargo

  • < 1.7.10affected
  • >= 1.8.0-rc.1, < 1.8.13affected
  • >= 1.9.0-rc.1, < 1.9.8affected
  • >= 1.10.0-rc.1, < 1.10.2affected

References