CVE-2026-61850

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the project-scoped RBAC API let an authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts confer permissions exceeding the...

CVE-2026-61850

The Kargo software (versions 0.6.0 until 1.8.14, 1.9.9, and 1.10.8) is vulnerable to privilege escalation due to authorization flaws in the project-scoped RBAC API. The root cause is that the API performs only a coarse resource-kind edit check rather than verifying each individual permission bein...

CVE-2026-61850 Kargo: Privilege escalation via Project RBAC management in the Kargo API

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the project-scoped RBAC API let an authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts confer permissions exceeding the...

CVE-2026-61850 Kargo: Privilege escalation via Project RBAC management in the Kargo API

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the project-scoped RBAC API let an authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts confer permissions exceeding the...

CVE-2026-61850: akuity kargo: Kargo manages and automates the promotion of software artifacts

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the project-scoped RBAC API let an authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts confer permissions exceeding the...