PT-2026-39215 · Kargo · Kargo

Pontushanssen · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-42350

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kargo versions prior to 1.7.10 Kargo versions prior to 1.8.13 Kargo versions prior to 1.9.8 Kargo versions prior to 1.10.2

Description Kargo, which manages and automates the promotion of software artifacts, contains an open redirect in the UI OIDC login flow. This occurs via the redirectTo query parameter.

Recommendations Update to version 1.7.10. Update to version 1.8.13. Update to version 1.9.8. Update to version 1.10.2.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-42350

Affected Products

Kargo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-42350 · Security Note
• https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf · Note
• https://t.me/CVEtracker/53172 · Telegram Post
• https://twitter.com/CVEnew/status/2053131413353009604 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052927079239319886 · Twitter Post
• https://twitter.com/vuldb/status/2053158955845878090 · Twitter Post