Executive brief
Kargo is a continuous delivery platform for Kubernetes deployments. The vulnerability allows an attacker to craft a malicious login link that redirects authenticated users to a fraudulent website after they sign in, enabling credential harvesting attacks. While the vulnerability itself does not expose Kargo data or compromise the platform, it leverages the user's trust in Kargo to facilitate phishing.
Technical details
The Kargo UI accepts an unsanitized `redirectTo` query parameter on the `/login` and `/token-renew` routes that is used for client-side navigation after successful OIDC authentication. The parameter is not constrained to the application's own origin, allowing protocol-relative URLs (e.g., `//attacker.example.com`) and backslash-prefixed paths (e.g., `/\attacker.example.com`) to redirect users to external domains. An attacker can craft URLs like `https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\attacker.example.com` and distribute them via email or messaging. When a victim follows the link and completes OIDC sign-in, they are redirected to the attacker's site, which inherits the perceived legitimacy of the Kargo domain. The exploit chain requires victim interaction (clicking the link and authenticating), making it suitable for phishing attacks. Patches are available in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
Affected products
- Akuity Kargo < 1.7.10; >= 1.8.0, < 1.8.13; >= 1.9.0, < 1.9.8; >= 1.10.0, < 1.10.2
Timeline
- 2026-04-22: disclosed
- 2026-04-22: patched: Patches released in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2
- 2026-08-27: advisory