CVE-2026-42350: Akuity Kargo open redirect in UI OIDC login flow

CVE-2026-42350 · Severity: medium · CVSS 4 · Published 2026-05-08

Kargo is a continuous delivery platform for Kubernetes deployments. The vulnerability allows an attacker to craft a malicious login link that redirects authenticated users to a fraudulent website after they sign in, enabling credential harvesting attacks. While the vulnerability itself does not expose Kargo data or compromise the platform, it leverages the user's trust in Kargo to facilitate phishing.

Technologies: github.com/akuity/kargo (Go). Vendors: Go.

Quick answers

Is CVE-2026-42350 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42350 being exploited in the wild.
How severe is CVE-2026-42350?
Medium severity, with a CVSS score of 4, published 8 May 2026.
Which products and versions are affected?
Akuity Kargo < 1.7.10, < 1.8.13, < 1.9.8, < 1.10.2, < 1.7.10, >= 1.8.0-rc.1, < 1.8.13, >= 1.9.0-rc.1, < 1.9.8, >= 1.10.0-rc.1, < 1.10.2, < 1.7.10; >= 1.8.0, < 1.8.13; >= 1.9.0, < 1.9.8; >= 1.10.0, < 1.10.2; github.com/akuity/kargo (Go) SEMVER:introduced=0,fixed=1.7.10, SEMVER:introduced=0,fixed=1.7.10,introduced=1.8.0,fixed=1.8.13,introduced=1.9.0,fixed=1.9.8,introduced=1.10.0,fixed=1.10.2.
Is there a fix for CVE-2026-42350?
Yes. github.com/akuity/kargo (Go): upgrade to 1.10.2, 1.7.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42350 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42350?
Check whether you run Akuity Kargo or github.com/akuity/kargo (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/akuity/kargo (Go): upgrade to 1.10.2, 1.7.10 or later
    go get github.com/akuity/kargo@v1.10.2

Technical details

The Kargo UI accepts an unsanitized `redirectTo` query parameter on the `/login` and `/token-renew` routes that is used for client-side navigation after successful OIDC authentication. The parameter is not constrained to the application's own origin, allowing protocol-relative URLs (e.g., `//attacker.example.com`) and backslash-prefixed paths (e.g., `/\attacker.example.com`) to redirect users to external domains. An attacker can craft URLs like `https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\attacker.example.com` and distribute them via email or messaging. When a victim follows the link and completes OIDC sign-in, they are redirected to the attacker's site, which inherits the perceived legitimacy of the Kargo domain. The exploit chain requires victim interaction (clicking the link and authenticating), making it suitable for phishing attacks. Patches are available in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Affected products

  • Akuity Kargo < 1.7.10; >= 1.8.0, < 1.8.13; >= 1.9.0, < 1.9.8; >= 1.10.0, < 1.10.2

Identifiers

  • CVE-2026-42350
  • GHSA-g7gw-m874-7rmf
  • GO-2026-6301

Timeline

  • 2026-04-22: disclosed
  • 2026-04-22: patched: Patches released in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2
  • 2026-08-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.