What is the CVSS score of CVE-2026-24748?

CVE-2026-24748 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Kubernetes are affected by CVE-2026-24748?

Kargo artifact management systems running versions prior to 1.8.7, 1.7.7, or 1.6.3 contain an authentication bypass vulnerability in the GetConfig() API endpoint, potentially allowing unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-24748?

Within 24 hours: Identify all Kargo deployments and confirm installed versions against the affected baseline (pre-1.8.7, pre-1.7.7, pre-1.6.3). Within 7 days: Apply available patches to all affected instances or implement compensating controls listed below if patching is blocked. Within 30 days: Complete remediation across all environments and validate patch deployment through security testing.

Kubernetes CVE-2026-24748

HIGH

Incorrect Authorization (CWE-863)

2026-01-27 security-advisories@github.com

GHSA-w5wv-wvrp-v5m5

Information Disclosure Kubernetes Golang Kargo Suse Akuity

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

SUSE

6.9 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 25, 2026 - 17:59 nvd

Patch available

CVE Published

Jan 27, 2026 - 22:15 nvd

HIGH 7.2

DescriptionGitHub Advisory

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the GetConfig() API endpoint. This allowed unauthenticated users to access this endpoint by specifying an Authorization header with any non-empty Bearer token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the RefreshResource endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. RefreshResource sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue.

AnalysisAI

Kargo's GetConfig() API endpoint fails to validate Bearer token authenticity, allowing unauthenticated attackers to retrieve sensitive configuration data including Argo CD cluster endpoints and namespaces that could facilitate further attacks. The same authentication bypass affects the RefreshResource endpoint, which can be leveraged for denial-of-service attacks. Versions 1.6.3, 1.7.7, and 1.8.7 and later include patches for this vulnerability.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects Kargo. Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the GetConfig() API endpoint. This allowed unauthenticated users to access this endpoint by specifying an Authorization header with any non-empty Bearer token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attack