← CVE Intelligence

CVE-2026-42350

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter PUBLISHED

Description (CNA)

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Affected (CNA)

Vendor / productVersions
akuity / kargoaffected < 1.7.10; affected >= 1.8.0-rc.1, < 1.8.13; affected >= 1.9.0-rc.1, < 1.9.8; affected >= 1.10.0-rc.1, < 1.10.2

CWE

CWE-601

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.