CVE-2026-24748

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the GetConfig API endpoint. This allowed unauthenticated users to access this endpoint by specifying an Authorization header with any non-empty...

CVE-2026-24748

Kargo contains a vulnerability in GetConfig() and RefreshResource() endpoints where any non-empty Bearer token bypasses authentication, allowing unauthenticated access and potential exfiltration of configuration data (e.g., Argo CD cluster endpoints) and, for RefreshResource, a DoS-style impact. ...