CVE-2026-32828: fallo de gravedad media en akuity kargo
Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.3%
Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery (SSRF) against link-local addresses, most critically the cloud instance metadata endpoint (169.254.169.254), enabling exfiltration of sensitive data such as IAM credentials. These steps provide full control over request headers and methods, rendering cloud provider header-based SSRF mitigations ineffective. An authenticated attacker with permissions to create/update Stages or craft Promotion resources can exploit this by submitting a malicious Promotion manifest, with response data retrievable via Promotion status fields, Git repositories, or a second http step. This issue has been fixed in versions 1.6.4, 1.7.9, 1.8.12 and 1.9.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Productos afectados
akuity · kargoCVEs relacionadas — akuity kargo
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-27112CRITICALKargo has an Authorization Bypass Vulnerability in Batch Resource Creation API EndpointsEPSS 0.5%CVE-2026-24748MEDIUMKargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated accessEPSS 0.4%CVE-2026-61850CRITICALKargo: Privilege escalation via Project RBAC management in the Kargo APIEPSS 0.4%CVE-2026-42350MEDIUMKargo: Open Redirect in UI OIDC Login Flow via redirectTo Query ParameterEPSS 0.3%CVE-2026-27111MEDIUMKargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API EndpointsEPSS 0.2%