PT-2026-21302 · Kargo · Kargo

B0B0Haha · Published 2026-02-19 · Updated 2026-03-03 · CVE-2026-27111

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Kargo versions 1.9.0 through 1.9.2

Description Kargo manages and automates the promotion of software artifacts. The authorization model includes a 'promote' verb intended to control access to promotion pipelines. While correctly enforced in the gRPC API, three endpoints in the REST API omit this check, relying solely on standard Kubernetes RBAC. This allows users with standard permissions, but without explicit 'promote' access, to bypass intended authorization boundaries. The affected API Endpoints are /v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream. The issue stems from a missing authorization check for the 'promote' verb on these endpoints.

Recommendations Upgrade to version 1.9.3 or later to resolve this issue.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-27111

GHSA-5VVM-67PJ-72G4

GO-2026-4515

SUSE-SU-2026:0757-1

Affected Products

Kargo

References · 115

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27111.json · Exploit
• https://github.com/akuity/kargo/commit/833314cad5513d48d89431493325ae44c1324a49 · Patch
• https://github.com/akuity/kargo/security/advisories/GHSA-5vvm-67pj-72g4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27111 · Security Note
• https://osv.dev/vulnerability/GO-2026-4515 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27111 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5vvm-67pj-72g4 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/akuity/kargo · Note
• https://suse.com/security/cve/CVE-2026-25518 · Note
• https://suse.com/security/cve/CVE-2026-26014 · Note
• https://suse.com/security/cve/CVE-2017-18907 · Note
• https://suse.com/security/cve/CVE-2026-25934 · Note
• https://suse.com/security/cve/CVE-2026-21438 · Note
• https://suse.com/security/cve/CVE-2026-25891 · Note