CVE-2026-42350 json
Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
published 2026-05-08 6 mo ago modified 2026-08-27 2 mo ago also EUVD-2026-28857 , GHSA-g7gw-m874-7rmf , GO-2026-6301
- cvss
- 5.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
Patch / fix
- go github.com/akuity/kargo 1.7.10, 1.8.13, 1.9.8, 1.10.2
- akuity kargo 1.7.10, 1.8.13, 1.9.8, 1.10.2
- govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1
suse advisories SUSE-SU-2026:23625-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1
opensuse advisories openSUSE-SU-2026:21761-1
- github.com/akuity/kargo@0b89215 commit
- github.com/akuity/kargo@52107be commit
- github.com/akuity/kargo@768b2a6 commit
- github.com/akuity/kargo@d2c8d18 commit
- github.com/akuity/kargo@db8ca6c commit
- github.com/akuity/kargo/releases/tag/v1.10.2 release
- github.com/akuity/kargo/releases/tag/v1.7.10 release
- github.com/akuity/kargo/releases/tag/v1.8.13 release
- github.com/akuity/kargo/releases/tag/v1.9.8 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/akuity/kargo | <1.7.10 >=1.8.0, <1.8.13 >=1.9.0, <1.9.8 >=1.10.0, <1.10.2 |
1.7.10 1.8.13 1.9.8 1.10.2 |
Affected products
- akuity kargo
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/akuity/kargo/commit/0b89215740e93d18f1ab2187f6f9733137f9d00f
web, patch
-
github.com
/akuity/kargo/commit/52107be1d392feaf02d640083cc000be5756f557
web, patch
-
github.com
/akuity/kargo/commit/768b2a62dcd70b7b2313290fea6c673e49e0c2d4
web, patch
-
github.com
/akuity/kargo/commit/d2c8d185b7cc43e225e0e2d17937511820479834
web, patch
-
github.com
/akuity/kargo/commit/db8ca6c015defc5ea29afb32cdea982b657f263a
web, patch
-
github.com
/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf
web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-42350
advisory
-
github.com
/akuity/kargo
package
-
github.com
/akuity/kargo/releases/tag/v1.10.2
web
-
github.com
/akuity/kargo/releases/tag/v1.7.10
web
-
github.com
/akuity/kargo/releases/tag/v1.8.13
web
-
github.com
/akuity/kargo/releases/tag/v1.9.8
web
Sources
- CVE List CVE-2026-42350
- GitHub Advisory GHSA-g7gw-m874-7rmf
- NVD CVE-2026-42350
- OSV GO-2026-6301
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.