GO-2026-6497 vulnerabilities

Vulnerabilities for packages: maru, opentofu, helm-mapkubeapis, cluster-api-helm-controller, kube-arangodb, rancher-helm, manifest-tool, k8sgpt, xeol, kargo, k9s, cert-manager-cmctl, gitness, helm-push, helm-set-status, kyverno-notation-aws, tigera-operator, flux-helm-controller...

GHSA-PG57-6JWG-Q645 vulnerabilities

Vulnerabilities for packages: dagger, eksctl, chartmuseum, docker, k8sgpt, nerdctl, kargo, k9s, kubescape, newrelic-infrastructure-agent, kubescape-operator, k3s, helm-set-status, falco-no-driver, skaffold, tigera-operator, trivy-operator, docker-cli-buildx, xeol, kubevela, zot, helm-mapkubeapis,...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: dagger, eksctl, chartmuseum, docker, k8sgpt, nerdctl, kargo, k9s, kubescape, newrelic-infrastructure-agent, kubescape-operator, k3s, helm-set-status, falco-no-driver, skaffold, tigera-operator, trivy-operator, docker-cli-buildx, xeol, kubevela, zot, helm-mapkubeapis,...

SUSE CVE-2026-42350

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2...

GO-2026-6301 Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo...

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...

GHSA-G7GW-M874-7RMF Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...

EUVD-2026-28857

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: kots, headlamp-fips, commercial-kyverno, zarf-fips, argo-cd, kubescape-operator-fips, gitlab-operator, k8ssandra-client, cloudbeat, cluster-api-helm-controller, argocd-image-updater-fips, maru, chaos-mesh, kube-arangodb, drone-fips, envoy-gateway, redpanda-operator,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dagger, k3d, conftest, rqlite, spire-server, smarter-device-manager, k8sgpt, kargo, k3s, grafana-agent-operator, opentelemetry-collector-contrib, guac, k8sgpt-operator, dex, falcosidekick, melange, zot, sigstore-scaffolding, restic, opa, terragrunt, temporal,...

GO-2025-4017 vulnerabilities

Vulnerabilities for packages: k8sgateway, spegel, kubo, frp, ipfs-cluster, traefik, dkron, q, kargo, kubernetes-dns-node-cache, kyverno-policy-reporter-ui, k3s, caddy...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: eksctl, chartmuseum, k8sgpt, cerbos, kargo, k9s, tw, k8ssandra-client, zot, pluto, istio, envoy-gateway, cert-manager-cmctl, flux-source-controller, kots, trivy, chart-testing, helm-push, cilium-cli, helm-operator, flux-helm-controller, zarf, rancher-fleet,...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: k8sgateway, spegel, kubo, frp, ipfs-cluster, seaweedfs, traefik, dkron, q, buf, kargo, kubernetes-dns-node-cache, k3s, caddy...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: dagger, flux-kustomize-controller, flux, goreleaser, k8sgpt, pulumi-language-java, kargo, k9s, kubescape, skaffold, nuclei, guac, argocd-image-updater, bom, gptscript, kubevela, melange, snyk-cli, zot, gitsign, tfsec, flux-source-controller, argo-events, kots, trivy,...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: dagger, trufflehog, spire-server, goreleaser, nerdctl, buf, k9s, kargo, tw, opentelemetry-collector-contrib, docker-cli-buildx, zot, melange, buildah, buildkitd, falcoctl, trivy, apko, grype, osv-scanner, docker-compose, aws-otel-collector, openfga, cadvisor, zarf,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: dagger, flux-kustomize-controller, flux, goreleaser, k8sgpt, pulumi-language-java, kargo, k9s, kubescape, skaffold, nuclei, guac, argocd-image-updater, bom, gptscript, kubevela, melange, snyk-cli, zot, gitsign, tfsec, flux-source-controller, argo-events, kots, trivy,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: dagger, trufflehog, kyverno, teleport, flux, nfpm, pulumi-language-java, cerbos, kargo, k9s, kubescape, xeol, skaffold, external-secrets-operator, nuclei, trivy-operator, guac, argocd-image-updater, bom, gptscript, kubevela, melange, snyk-cli, zot, gitsign, tfsec,...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, argo-rollouts, kubeflow-pipelines, opentelemetry-collector, argo-workflows, nats, k8sgpt, kargo, amazon-cloudwatch-agent, grafana-alloy, opentelemetry-collector-contrib...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: dagger, ko, conftest, spire-server, tkn, buf, kargo, kubescape, zot, melange, aactl, buildkitd, trivy, grype, docker-compose, cadvisor, up, crossplane, cilium-cli, wolfictl, kaniko, ctop, syft...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: podman, crossplane-provider-aws-kms, tkn, docker, pulumi-language-java, crossplane-provider-aws-rds, kargo, k9s, kubescape, nerdctl, nuclei, melange, crossplane-provider-aws-sqs, gatus, cosign, crossplane-provider-azure-storage, crossplane-provider-aws-iam, trivy,...