CVE-2026-24748

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24748", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-26T19:06:16.060Z", "datePublished": "2026-01-27T21:23:53.890Z", "dateUpdated": "2026-01-28T21:15:14.453Z"}, "containers": {"cna": {"title": "Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5"}, {"name": "https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772", "tags": ["x_refsource_MISC"], "url": "https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772"}, {"name": "https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7", "tags": ["x_refsource_MISC"], "url": "https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7"}, {"name": "https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c", "tags": ["x_refsource_MISC"], "url": "https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c"}], "affected": [{"vendor": "akuity", "product": "kargo", "versions": [{"version": "< 1.6.3", "status": "affected"}, {"version": ">= 1.7.0, < 1.7.7", "status": "affected"}, {"version": "<= 1.8.0, < 1.8.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-27T21:23:53.890Z"}, "descriptions": [{"lang": "en", "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-empty `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue."}], "source": {"advisory": "GHSA-w5wv-wvrp-v5m5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T21:15:08.264236Z", "id": "CVE-2026-24748", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T21:15:14.453Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24748", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T21:15:08.264236Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T21:15:11.640Z"}}], "cna": {"title": "Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access", "source": {"advisory": "GHSA-w5wv-wvrp-v5m5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "akuity", "product": "kargo", "versions": [{"status": "affected", "version": "< 1.6.3"}, {"status": "affected", "version": ">= 1.7.0, < 1.7.7"}, {"status": "affected", "version": "<= 1.8.0, < 1.8.7"}]}], "references": [{"url": "https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5", "name": "https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772", "name": "https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7", "name": "https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c", "name": "https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-empty `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-27T21:23:53.890Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24748", "state": "PUBLISHED", "dateUpdated": "2026-01-28T21:15:14.453Z", "dateReserved": "2026-01-26T19:06:16.060Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-27T21:23:53.890Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kargo", "vendor": "akuity", "versions": [{"status": "affected", "version": "< 1.6.3"}, {"status": "affected", "version": ">= 1.7.0, < 1.7.7"}, {"status": "affected", "version": "<= 1.8.0, < 1.8.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:akuity:kargo:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "E523C042-4A9D-4F89-8D9D-AAA82F28239C", "versionEndExcluding": "1.6.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:akuity:kargo:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "199BD7B6-D9D9-4E14-A47F-54E8EDA91D42", "versionEndExcluding": "1.7.7", "versionStartIncluding": "1.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:akuity:kargo:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "87AFF1D2-3872-463C-BA4C-D6C31C3B9EBC", "versionEndExcluding": "1.8.7", "versionStartIncluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-empty `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue."}, {"lang": "es", "value": "Kargo gestiona y automatiza la promoci\u00f3n de artefactos de software. Antes de las versiones 1.8.7, 1.7.7 y 1.6.3, se encontr\u00f3 un error con las comprobaciones de autenticaci\u00f3n en el endpoint de la API 'GetConfig()'. Esto permit\u00eda a usuarios no autenticados acceder a este endpoint especificando una cabecera 'Authorization' con cualquier valor de token 'Bearer' no vac\u00edo, independientemente de su validez. Esta vulnerabilidad permit\u00eda la exfiltraci\u00f3n de datos de configuraci\u00f3n, como endpoints para cl\u00fasteres de Argo CD conectados. Estos datos podr\u00edan permitir a un atacante enumerar URLs de cl\u00faster y espacios de nombres para su uso en ataques posteriores. Adem\u00e1s, el mismo error afectaba al endpoint 'RefreshResource'. Este endpoint no conduce a ninguna revelaci\u00f3n de informaci\u00f3n, pero podr\u00eda ser utilizado por un atacante no autenticado para realizar un ataque de estilo denegaci\u00f3n de servicio contra la API de Kargo. 'RefreshResource' establece una anotaci\u00f3n en recursos espec\u00edficos de Kubernetes para activar reconciliaciones. Si se ejecuta en un bucle constante, esto tambi\u00e9n podr\u00eda ralentizar las solicitudes leg\u00edtimas al servidor de la API de Kubernetes. Este problema ha sido parcheado en las versiones de Kargo 1.8.7, 1.7.7 y 1.6.3. No hay soluciones alternativas para este problema."}], "id": "CVE-2026-24748", "lastModified": "2026-06-17T10:23:31.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24748", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T21:15:08.264236Z", "version": "2.0.3"}}]}, "published": "2026-01-27T22:15:56.630", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T18:45:17.884836+00:00", "value": {"mitigation_remediation": ["Upgrade Kargo to version 1.8.7 or later (or the equivalent fixed release in previous major versions).", "Limit access to the Kargo API to known, trusted IP addresses or network segments.", "Enable rate limiting or request throttling for the RefreshResource endpoint to mitigate denial\u2011of\u2011service attempts."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Akuity Kargo deployments are vulnerable if they run any version older than 1.8.7, 1.7.7, or 1.6.3. These releases lack the necessary authentication guard on the GetConfig() and RefreshResource APIs. Upgrading to the patched versions removes the flaw.", "description_and_impact": "Kargo exposes the GetConfig() API endpoint without proper authentication checks, allowing any user who provides a non\u2011empty Bearer token to retrieve configuration data such as Argo\u202fCD cluster endpoints. Adversaries can use this information to enumerate cluster URLs and namespaces, potentially enabling further attacks. The same flaw applies to the RefreshResource endpoint; while it does not reveal data, an unauthenticated attacker could invoke it repeatedly to trigger reconciliations, creating a denial\u2011of\u2011service effect by overloading the Kubernetes API server.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.9, indicating moderate severity. The EPSS score is less than 1%, suggesting low current exploitation probability, and the flaw is not listed in the CISA KEV catalog. Exploitation requires only network access to the Kargo API and the provision of any non\u2011empty Bearer token, meaning the attack vector is external API access and does not require privileged credentials."}}}}, "created": "2026-01-28T12:22:14.644597+00:00", "updated": "2026-04-18T19:00:08.017296+00:00", "vendors": ["akuity", "akuity$PRODUCT$kargo"]}