CVE Catalog
CVE-2026-42350
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk0.24%
15th percentile - higher than 15% of all known CVEs
Summary
Kargo before versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2 is vulnerable to open redirect in the UI OIDC login flow via the 'redirectTo' query parameter.
Risk Assessment
An attacker can redirect the victim to a malicious site after login, potentially leading to token theft or phishing.
Recommendation
Update Kargo to version 1.7.10, 1.8.13, 1.9.8, or 1.10.2 depending on your branch.
Original NVD description (English source)
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.