PT-2026-26462 · Kargo · Kargo

Maru1009 · Published 2026-03-16 · Updated 2026-03-27 · CVE-2026-32828

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kargo versions 1.4.0 through 1.6.3 Kargo versions 1.7.0-rc.1 through 1.7.8 Kargo versions 1.8.0-rc.1 through 1.8.11 Kargo versions 1.9.0-rc.1 through 1.9.4

Description Kargo's built-in http and http-download promotion steps allow Server-Side Request Forgery (SSRF) against link-local addresses, specifically the cloud instance metadata endpoint (169.254.169.254). These steps provide full control over request headers and methods, bypassing cloud provider header-based SSRF mitigations. An authenticated attacker with permissions to create or update Stages or craft Promotion resources can exploit this by submitting a malicious Promotion manifest. Response data can be retrieved via Promotion status fields, Git repositories, or a second http step. The issue enables the exfiltration of sensitive data, such as IAM credentials. The http step provides full control over request method and headers, while the http-download step provides control over headers only.

Recommendations Versions 1.4.0 through 1.6.3 should be upgraded to version 1.6.4 or later. Versions 1.7.0-rc.1 through 1.7.8 should be upgraded to version 1.7.9 or later. Versions 1.8.0-rc.1 through 1.8.11 should be upgraded to version 1.8.12 or later. Versions 1.9.0-rc.1 through 1.9.4 should be upgraded to version 1.9.5 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-32828

GHSA-J94X-8WCP-X7HM

GO-2026-4717

SUSE-SU-2026:1135-1

Affected Products

Kargo

References · 149

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32828.json · Exploit
• https://github.com/akuity/kargo/commit/fd25620c2473ed19bec4be4d0f181287ef0f0391 · Patch
• https://github.com/akuity/kargo/security/advisories/GHSA-j94x-8wcp-x7hm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32828 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32828 · Security Note
• https://osv.dev/vulnerability/GHSA-j94x-8wcp-x7hm · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4717 · Vendor Advisory
• https://github.com/akuity/kargo · Note
• https://suse.com/security/cve/CVE-2026-33481 · Note
• https://suse.com/security/cve/CVE-2026-33203 · Note
• https://suse.com/security/cve/CVE-2026-26246 · Note
• https://suse.com/security/cve/CVE-2026-27889 · Note
• https://suse.com/security/cve/CVE-2026-32285 · Note
• https://suse.com/security/cve/CVE-2026-33529 · Note