cve.bz

CVE-2026-42350

5.1 mediumEPSS 0.3%

Medium (5.1). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/akuity/kargo 1.10.2, 1.7.10, 1.8.13.

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Severity

CVSS 4.0

5.1 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE
CWE-601
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g7gw-m874-7rmfGogithub.com/akuity/kargo<1.7.101.7.10
GHSA-g7gw-m874-7rmfGogithub.com/akuity/kargo>=1.8.0 <1.8.131.8.13
GHSA-g7gw-m874-7rmfGogithub.com/akuity/kargo>=1.9.0 <1.9.81.9.8
GHSA-g7gw-m874-7rmfGogithub.com/akuity/kargo>=1.10.0 <1.10.21.10.2
GO-2026-6301Gogithub.com/akuity/kargo<1.7.10
>=1.8.0 <1.8.13
>=1.9.0 <1.9.8
>=1.10.0 <1.10.2		1.7.10, 1.8.13, 1.9.8, 1.10.2

References

Check your stackJSON