PT-2026-21302 · Kargo · Kargo
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
Kargo versions 1.9.0 through 1.9.2
Description
Kargo manages and automates the promotion of software artifacts. The authorization model includes a 'promote' verb intended to control access to promotion pipelines. While correctly enforced in the gRPC API, three endpoints in the REST API omit this check, relying solely on standard Kubernetes RBAC. This allows users with standard permissions, but without explicit 'promote' access, to bypass intended authorization boundaries. The affected API Endpoints are /v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream. The issue stems from a missing authorization check for the 'promote' verb on these endpoints.
Recommendations
Upgrade to version 1.9.3 or later to resolve this issue.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kargo