Kargo’s batch resource creation endpoints in both its legacy gRPC and newer REST APIs accepted multi-document YAML payloads. A flaw in the logic of these endpoints allows an attacker to insert arbitrary resources of certain types into a Project’s namespace using the API server’s own permissions, when that behavior was not intended. This effectively bypasses authorization controls and can elevate the attacker’s permissions, enabling remote code execution or exfiltration of secrets. The vulnerability is a classic authorization bypass (CWE-863) that exposes the control plane’s underlying Kubernetes cluster to elevated attacks.

The affected vendor is Akuity Kargo. Versions from 1.7.0 up to 1.7.7, from 1.8.0 up to 1.8.10, and from 1.9.0 up to 1.9.2 are impacted. These releases accepted multi‑document YAML payloads on both the legacy gRPC API and the newer REST API.

The vulnerability has a CVSS score of 9.4, indicating critical severity, while the EPSS score of <1% suggests a low current exploitation probability, and it is not listed in the CISA KEV catalog. However, because the flaw permits injection of resources with the API server’s permissions, an attacker with minimal access can potentially gain cluster‑level privileges. The attack vector likely involves sending crafted YAML through permitted API endpoints, and no additional prerequisites beyond API access are mentioned in the description. Patching to the fixed releases removes the ability to inject and thus eliminates the risk.