Vulnerabilities

TI-2026-25295 CVE-2026-32828 · GHSA-j94x-8wcp-x7hm

Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration

LOW 23

Kargo manages and automates the promotion of software artifacts.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00341 Published 2026-03-20 Fixed in 1.6.4, 1.7.9 +2 CWE-918

TI-2026-21564 CVE-2026-27112 · GHSA-7g9x-cp9g-92mr

MEDIUM 49

Kargo manages and automates the promotion of software artifacts.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00491 Published 2026-02-20 Fixed in 1.9.3, 1.8.11 +1 CWE-863

TI-2026-21563 CVE-2026-27111 · GHSA-5vvm-67pj-72g4

LOW 29

Kargo manages and automates the promotion of software artifacts.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00205 Published 2026-02-20 Fixed in 1.9.3 CWE-862

TI-2026-19953 CVE-2026-24748 · GHSA-w5wv-wvrp-v5m5

LOW 31

Kargo manages and automates the promotion of software artifacts.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00393 Published 2026-01-27 Fixed in 1.6.3, 1.7.7 +1 CWE-863