Read the docs
TI-2026-19953 Aliases CVE-2026-24748GHSA-w5wv-wvrp-v5m5

Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-empty `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00393 33rd percentileScored 2026-11-07
Fix Fixed kargo (akuity): 1.6.3, 1.7.7github.com/akuity/kargo (Go): 1.6.3, 1.7.7, 1.8.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
akuitykargobefore 1.6.3; 1.7.0 to before 1.7.7; <= 1.8.0, < 1.8.71.6.3, 1.7.7Patch availableCNA
—github.com/akuity/kargo (Go)before 1.6.31.6.3Patch availableGHSA-w5wv-wvrp-v5m5
—github.com/akuity/kargo (Go)1.7.0-rc.1 to before 1.7.71.7.7Patch availableGHSA-w5wv-wvrp-v5m5
—github.com/akuity/kargo (Go)1.8.0-rc.1 to before 1.8.71.8.7Patch availableGHSA-w5wv-wvrp-v5m5
  • kargo Vendorakuity Affected before 1.6.3; 1.7.0 to before 1.7.7; <= 1.8.0, < 1.8.7 Fixed in 1.6.3, 1.7.7 Patch available CNA
  • github.com/akuity/kargo (Go) Vendor— Affected before 1.6.3 Fixed in 1.6.3 Patch available GHSA-w5wv-wvrp-v5m5
  • github.com/akuity/kargo (Go) Vendor— Affected 1.7.0-rc.1 to before 1.7.7 Fixed in 1.7.7 Patch available GHSA-w5wv-wvrp-v5m5
  • github.com/akuity/kargo (Go) Vendor— Affected 1.8.0-rc.1 to before 1.8.7 Fixed in 1.8.7 Patch available GHSA-w5wv-wvrp-v5m5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:akuity:kargo:*:*:*:*:*:kubernetes:*:*before 1.6.3; 1.7.0 to before 1.7.7; 1.8.0 to before 1.8.7Vulnerableakuity
  • cpe:2.3:a:akuity:kargo:*:*:*:*:*:kubernetes:*:* Versions before 1.6.3; 1.7.0 to before 1.7.7; 1.8.0 to before 1.8.7 Vulnerable ·akuity

Remediation

  • Fix · CNA kargo (akuity) Fixed in 1.6.3, 1.7.7
  • Fix · GHSA-w5wv-wvrp-v5m5 github.com/akuity/kargo (Go) Fixed in 1.6.3 Advisory →
  • Fix · GHSA-w5wv-wvrp-v5m5 github.com/akuity/kargo (Go) Fixed in 1.7.7 Advisory →
  • Fix · GHSA-w5wv-wvrp-v5m5 github.com/akuity/kargo (Go) Fixed in 1.8.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24748
  2. 2026-10-03 Alias added: GHSA-w5wv-wvrp-v5m5

References

Patch 3

Advisory 2

Other 1

  • TI-2026-21564 Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints CVSS 4.0CRITICAL 9.4
  • TI-2026-21563 Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints CVSS 4.0MEDIUM 5.3
  • TI-2026-25295 Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences