PT-2026-5025 · Kargo · Kargo

Thomastaylor312 · Published 2026-01-27 · Updated 2026-02-06 · CVE-2026-24748

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Kargo versions prior to 1.8.7 Kargo versions prior to 1.7.7 Kargo versions prior to 1.6.3

Description Kargo is a tool for managing and automating the promotion of software artifacts. A flaw in authentication checks on the GetConfig() API endpoint and the RefreshResource endpoint allowed unauthenticated users to gain access. Specifically, providing any non-empty Bearer token value in the Authorization header bypassed authentication. Access to the GetConfig() endpoint could lead to the exposure of configuration data, including endpoints for connected Argo CD clusters, potentially enabling an attacker to enumerate cluster URLs and namespaces. The RefreshResource endpoint, when repeatedly accessed, could be exploited to launch a denial-of-service attack against the Kargo API by triggering excessive reconciliations on Kubernetes resources, potentially impacting the Kubernetes API server's performance. The Authorization header and the Bearer token are key components in this issue.

Recommendations Upgrade to Kargo version 1.8.7 or later. Upgrade to Kargo version 1.7.7 or later. Upgrade to Kargo version 1.6.3 or later.

Exploit

Fix

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-24748

GHSA-W5WV-WVRP-V5M5

GO-2026-4385

SUSE-SU-2026:0403-1

Affected Products

Kargo

References · 91

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24748.json · Exploit
• https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772 · Patch
• https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5 · Vendor Advisory
• https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c · Patch
• https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w5wv-wvrp-v5m5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24748 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24748 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4385 · Vendor Advisory
• https://github.com/akuity/kargo · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note
• https://suse.com/security/cve/CVE-2026-24740 · Note