Akuity Kargo allows an attacker to use the http and http-download promotion steps to send requests to internal link-local addresses, such as the cloud instance metadata service at 169.254.169.254. By crafting a malicious Promotion manifest, an authenticated user with permission to create or update Stages can cause Kargo to fetch arbitrary internal resources and return the payload in Promotion status fields, Git repositories, or a subsequent http step. The response data can contain sensitive IAM credentials, secrets, or other administrative information, leading to information disclosure and potential credential compromise.

Affected versions of the Akuity Kargo product include 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4. All instances running any of these releases are vulnerable.

The Common Vulnerability Scoring System assigns a severity of 5.1, indicating a moderate impact; the Exploit Prediction Scoring System reports a likelihood of less than 1%, suggesting the vulnerability is not widely exploited yet, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated attacker who can modify Promotion resources, meaning that the attack vector likely originates from within the Kubernetes cluster or via a compromised account with sufficient privileges. Because the vulnerability bypasses typical header‑based SSRF mitigations, standard defenses may not prevent it, increasing the potential for internal network reconnaissance and credential theft.