PT-2026-20879 · Kargo · Kargo

B0B0Haha · Published 2026-02-19 · Updated 2026-03-03 · CVE-2026-27112

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kargo versions 1.7.0 through 1.7.7 Kargo version 1.8.11 Kargo version 1.9.3

Description Kargo manages and automates the promotion of software artifacts. The batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can allow an attacker to inject arbitrary resources into the underlying namespace of an existing Project using the API server's own permissions when this behavior is not intended. This can be exploited to elevate permissions, potentially leading to remote code execution or secret exfiltration. Exfiltrated artifact repository credentials could be used for further attacks. In some Kubernetes cluster configurations, elevated permissions may enable remote code execution or secret exfiltration using kubectl. The API Endpoints affected are the batch resource creation endpoints of both the legacy gRPC API and the newer REST API. The issue stems from the logic within these endpoints when processing multi-document YAML payloads. An attacker can leverage this to inject resources into existing Projects.

Recommendations Update to Kargo version 1.7.8 or later. Update to Kargo version 1.8.11. Update to Kargo version 1.9.3 or later.

Exploit

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-27112

GHSA-7G9X-CP9G-92MR

GO-2026-4516

SUSE-SU-2026:0757-1

Affected Products

Kargo

References · 117

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27112.json · Exploit
• https://github.com/akuity/kargo/security/advisories/GHSA-7g9x-cp9g-92mr · Vendor Advisory
• https://github.com/akuity/kargo/commit/155c6852ffbffa2902f18e6c7add91a846e8d344 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27112 · Security Note
• https://osv.dev/vulnerability/GO-2026-4516 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27112 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7g9x-cp9g-92mr · Vendor Advisory
• https://github.com/akuity/kargo · Note
• https://suse.com/security/cve/CVE-2026-26314 · Note
• https://suse.com/security/cve/CVE-2026-27017 · Note
• https://suse.com/security/cve/CVE-2017-18873 · Note
• https://suse.com/security/cve/CVE-2025-67860 · Note
• https://suse.com/security/cve/CVE-2026-27587 · Note
• https://suse.com/security/cve/CVE-2017-18907 · Note