Executive brief
Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access in github.com/akuity/kargo
Affected products
- Go github.com/akuity/kargo
Junglewise Threat Intelligence
CVE-2026-24748: GO-2026-4385 - Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access in github.com/akuity/kargo
CVE-2026-24748 · Severity: medium · CVSS 4 · Published 2026-02-02
Technologies: github.com/akuity/kargo (Go). Vendors: Go.
Related threats
- Akuity Kargo open redirect in UI OIDC login flow
- GO-2026-4717 - Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration in github.com/akuity/ka
- GO-2026-4516 - Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints in github.com/akuity/kargo
- GO-2026-4515 - Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints in github.com/akuity/kargo