CVE-2026-27112

CVE-2026-27112 affects Kargo’s batch resource creation endpoints (legacy gRPC and newer REST API). In versions 1.7.0–before 1.7.8, 1.8.11, and 1.9.3, the endpoints accept multi-document YAML payloads and contain a logic bug that can inject arbitrary resources into the underlying Kubernetes namesp...

CVE-2026-24748

CVE-2026-24748 affects Kargo (GitHub repo github.com/akuity/kargo) where GetConfig() and RefreshResource() endpoints allow unauthenticated access via any non-empty Bearer token. This can lead to exfiltration of configuration data (e.g., endpoints for connected Argo CD clusters) and enable a denia...

CVE-2026-27111

The CVE-2026-27111 issue affects Kargo v1.9.0–v1.9.2, where the REST API endpoints (/v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream) fail to enforce the non-standard ...

CVE-2026-32828

CVE-2026-32828 affects Kargo promotions: versions 1.4.0–1.6.3, 1.7.0-rc.1–1.7.8, 1.8.0-rc.1–1.8.11, and 1.9.0-rc.1–1.9.4 have HTTP/http-download promotion steps that allow SSRF against link-local addresses, notably 169.254.169.254, enabling exfiltration of sensitive data (e.g., IAM credentials) w...