EUVD-2026-28857
GHSA-g7gw-m874-7rmf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious login URL
-
DeliveryAttacker sends link via email or posts on forum
-
ExploitVictim clicks link containing redirectTo parameter
-
ExecutionKargo redirects to attacker-controlled domain
-
ImpactAttacker captures credentials or session tokens
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The redirectTo query parameter must be present in the OIDC login flow endpoint, and the user must click a link containing a malicious redirectTo value. The vulnerability requires no authentication, no special Kargo configuration (affects default login flows), and no special privileges. However, exploitation is limited by the UI:A (user interaction) requirement - the attacker cannot force a redirect without the victim's action (clicking a link, submitting a form). Additionally, the victim must reach the login endpoint, implying either they are not yet authenticated or the session has expired. Exploitation is further limited to users and organizations that expose their Kargo instance to external users or allow users to access URLs from untrusted sources (e.g., email links from outside the organization). |
| Impact | The CVSS vector shows AV:N (network), AC:L (low complexity), PR:N (no privileges required), but UI:A (requires user interaction) and SC:L (limited scope), yielding a CVSS 5.1 (medium). The user interaction requirement significantly reduces real-world exploitability compared to fully remote exploitation - attackers must trick users into clicking a specially crafted link. However, open redirects in authentication flows are high-value targets for phishing campaigns because they can lend legitimacy to credential harvesting attacks (attacker's phishing site appears to be reached via legitimate Kargo login). The EPSS score and KEV status are not provided, so public exploitation likelihood cannot be assessed from available data. Given the simplicity of the vulnerability class (no authentication, low technical complexity) and its presence in an authentication-critical component, the realistic risk to Kargo deployments is MEDIUM if users are exposed to untrusted input sources (e.g., phishing emails, forum posts) but LOW if used in fully internal/air-gapped environments with restricted user populations. |
| Exploit ScenarioDerived | An attacker crafts a phishing email containing a link to the victim's Kargo login page with a malicious redirectTo parameter, e.g., https://kargo.example.com/login?redirectTo=https://attacker.com/phishing. When the victim clicks the link and completes OIDC authentication, Kargo redirects them to the attacker's phishing site, which mimics the Kargo UI to harvest credentials or session tokens. The exploit succeeds because the victim is already authenticated at that point and may trust the redirect as part of normal workflow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 09, 2026
Open redirect vulnerability in Kargo UI OIDC login flow allows unauthenticated remote attackers to redirect users to arbitrary external websites via a malicious redirectTo query parameter. Versions prior to 1.7.10, 1.8.13, 1.9.8, and 1.10.2 are affected. This requires user interaction (clicking a crafted link) but can facilitate phishing attacks by making malicious redirects appear legitimate within the Kargo authentication flow.
RemediationAI
Upgrade Kargo to version 1.7.10, 1.8.13, 1.9.8, 1.10.2, or later depending on your current minor version branch. The patched versions validate the redirectTo parameter against a whitelist of safe redirect destinations (typically the Kargo UI's own domain) before issuing the redirect. No workarounds are documented for unpatched versions; however, network-level controls such as a Web Application Firewall (WAF) can be configured to block requests containing suspicious redirectTo parameter values pointing to external domains. This introduces operational overhead and may introduce false positives if legitimate cross-origin scenarios exist. The recommended approach is to upgrade promptly, especially if Kargo is exposed to users who may receive phishing emails or click external links.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kargo is a software artifact promotion and deployment automation platform that integrates OIDC (OpenID Connect) for federated authentication in its web UI. The vulnerability resides in the OIDC login redirect handler, which fails to validate or sanitize the redirectTo query parameter before using it in an HTTP redirect response. This is a classic CWE-601 (URL redirection to untrusted site) vulnerability where user-supplied input is used directly in a Location header or equivalent redirect mechanism without proper validation against a whitelist of safe redirect destinations. The attack surface is the login/authentication endpoint of the Kargo UI, exposed over the network to any user with access to the application's web interface.
Know when Kargo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Authorization bypass in Kargo Kubernetes promotion tool from 1.7.0 before 1.7.8/1.8.11/1.9.3. Batch resource creation by
Privilege escalation in Kargo versions from 0.6.0 before 1.8.14, 1.9.9, and 1.10.8 lets an authenticated user with a del
Kargo's GetConfig() API endpoint fails to validate Bearer token authenticity, allowing unauthenticated attackers to retr
Kargo versions 1.4.0-1.6.3, 1.7.0-1.7.8, 1.8.0-1.8.11, and 1.9.0-1.9.4 contain a Server-Side Request Forgery vulnerabili
Kargo versions 1.9.0 through 1.9.2 fail to enforce the custom "promote" authorization verb in three REST API endpoints,
Exploit-DB