PT-2026-21302 · Kargo · Kargo

B0B0Haha

·

Publicado

2026-02-19

·

Atualizado

2026-03-03

·

CVE-2026-27111

CVSS v4.0

5.3

Média

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Name of the Vulnerable Software and Affected Versions Kargo versions 1.9.0 through 1.9.2
Description Kargo manages and automates the promotion of software artifacts. The authorization model includes a 'promote' verb intended to control access to promotion pipelines. While correctly enforced in the gRPC API, three endpoints in the REST API omit this check, relying solely on standard Kubernetes RBAC. This allows users with standard permissions, but without explicit 'promote' access, to bypass intended authorization boundaries. The affected API Endpoints are /v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream. The issue stems from a missing authorization check for the 'promote' verb on these endpoints.
Recommendations Upgrade to version 1.9.3 or later to resolve this issue.

Exploit

Correção

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-27111
GHSA-5VVM-67PJ-72G4
GO-2026-4515
SUSE-SU-2026:0757-1

Produtos afetados

Kargo