SUSE CVE-2026-24748

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the GetConfig API endpoint. This allowed unauthenticated users to access this endpoint by specifying an Authorization header with any non-empty...

GO-2026-4385 Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access in github.com/akuity/kargo

Kargo's GetConfig and RefreshResource API endpoints allow unauthenticated access in github.com/akuity/kargo...

CVE-2026-24748

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the GetConfig API endpoint. This allowed unauthenticated users to access this endpoint by specifying an Authorization header with any non-empty...

EUVD-2026-4736

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the GetConfig API endpoint. This allowed unauthenticated users to access this endpoint by specifying an Authorization header with any non-empty...

CVE-2026-24748

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the GetConfig API endpoint. This allowed unauthenticated users to access this endpoint by specifying an Authorization header with any non-empty...

Kargo security vulnerabilities

Kargo is an open-source continuous delivery tool developed by Akuity. Versions of Kargo prior to 1.8.7, 1.7.7, and 1.6.3 contained security vulnerabilities. These vulnerabilities stemmed from defects in the authentication checks for the GetConfig and RefreshResource API endpoints, which could all...

PT-2026-5025

Name of the Vulnerable Software and Affected Versions Kargo versions prior to 1.8.7 Kargo versions prior to 1.7.7 Kargo versions prior to 1.6.3 Description Kargo is a tool for managing and automating the promotion of software artifacts. A flaw in authentication checks on the GetConfig API endpoin...

GHSA-CFPF-HRX2-8RV6 vulnerabilities

Vulnerabilities for packages: tempo, k8sgateway, k8sgpt, argo-cd, opentelemetry-collector-contrib, coredns, aws-otel-collector, vale, argo-workflows, opentelemetry-collector, nats, amazon-cloudwatch-agent, datadog-agent, kubeflow-pipelines, kine, k3s, splunk-otel-collector, argo-rollouts, kargo,...

CVE-2025-68156 vulnerabilities

Vulnerabilities for packages: tempo, k8sgateway, k8sgpt, argo-cd, opentelemetry-collector-contrib, coredns, aws-otel-collector, vale, argo-workflows, opentelemetry-collector, nats, amazon-cloudwatch-agent, datadog-agent, kubeflow-pipelines, kine, k3s, splunk-otel-collector, argo-rollouts, kargo,...

GHSA-CFPF-HRX2-8RV6 vulnerabilities

Vulnerabilities for packages: eks-distro, coredns, nats-fips, kine, aws-otel-collector-fips, vale, tempo-fips, k8sgateway, opentelemetry-collector-contrib, k8sgateway-fips, elastic-agent, k8sgpt, k3s, verticadb-operator, opentelemetry-collector-fips, argo-cd, argo-workflows, argo-workflows-fips,...

CVE-2025-68156 vulnerabilities

Vulnerabilities for packages: eks-distro, coredns, nats-fips, kine, aws-otel-collector-fips, vale, tempo-fips, k8sgateway, opentelemetry-collector-contrib, k8sgateway-fips, elastic-agent, k8sgpt, k3s, verticadb-operator, opentelemetry-collector-fips, argo-cd, argo-workflows, argo-workflows-fips,...

EUVD-2025-11119

Malicious code in bioql PyPI...

WordPress Kargo Theme <= 1.1.13 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Kargo versions = 1.1.13...

WordPress Kargo Theme <= 1.1.13 is vulnerable to Local File Inclusion

Software Kargo Type Theme Vulnerable versions = 1.1.13 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 31c938be3ceb Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2025-53547 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, istio, eksctl, chart-testing, helm-operator, zarf, k8sgpt, kots, k9s, rancher-fleet, linkerd2, cilium-cli, helm-docs, flux-helm-controller, cerbos, trivy, tw, helm-push, consul-k8s, rancher-helm, zot, envoy-gateway, chartmuseum, pluto,...

GHSA-557J-XG8C-Q2MM vulnerabilities

Vulnerabilities for packages: k8ssandra-client, istio, eksctl, chart-testing, helm-operator, zarf, k8sgpt, kots, k9s, rancher-fleet, linkerd2, cilium-cli, helm-docs, flux-helm-controller, cerbos, trivy, tw, helm-push, consul-k8s, rancher-helm, zot, envoy-gateway, chartmuseum, pluto,...

CVE-2025-26908

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Injection.This issue affects Kargo Entegratör: from n/a through = 1.1.14...

CVE-2025-26908

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Injection.This issue affects Kargo Entegratör: from n/a through = 1.1.14...

CVE-2025-26908

CVE-2025-26908 (Kargo Entegratör – WooCommerce Kargo Entegrasyon Eklentisi) authenticates as Shop Manager+ and suffers SQL Injection due to improper neutralization. Affected versions: up to 1.1.14. Red Hat entry confirms the vulnerability and notes a patch has been applied; Wordfence WordPress pl...

CVE-2025-26908 WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Injection.This issue affects Kargo Entegratör: from n/a through = 1.1.14...