CVE-2026-42350

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Published May 8, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Analysis

Technical impact

Kargo allows attackers to supply a misleading redirectTo query parameter in the UI OIDC login flow. The parameter is not validated, enabling an attacker to transfer the user to an arbitrary URL after authentication. This flaw can be leveraged for phishing or other malicious landing pages, potentially leading to credential theft or malware delivery. The issue is a classic open redirect weakness (CWE‑601).

Affected Systems

The vulnerability affects Akuity Kargo versions prior to 1.7.10, 1.8.13, 1.9.8, and 1.10.2. All earlier releases contain an unvalidated redirectTo parameter in the login endpoint. Upgrading to the specified patched releases resolves the issue.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium impact level. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a login URL containing a malicious redirectTo value; no special privileges or credential compromise are required to trigger the redirect. Given the ease of constructing such a URL, the risk to users remains moderate but should be addressed promptly.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

akuity

kargo

affected

Version	Status	Constraints
`< 1.7.10`	affected	—
`>= 1.8.0-rc.1, < 1.8.13`	affected	—
`>= 1.9.0-rc.1, < 1.9.8`	affected	—
`>= 1.10.0-rc.1, < 1.10.2`	affected	—

No data.

Vendor Product Versions

Akuity

Kargo

Version	Status	Scheme	Platform
`[0,1.7.10)`	affected	semver	—
`[1.8.0-rc.1,1.8.13)`	affected	semver	—
`[1.9.0-rc.1,1.9.8)`	affected	semver	—
`[1.10.0-rc.1,1.10.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Kargo to version 1.7.10, 1.8.13, 1.9.8, or 1.10.2 or later to receive the fix for the redirectTo validation.
If an upgrade is not possible, restrict the redirectTo parameter to a whitelist of trusted domains or disable the parameter entirely in the authentication flow.
Validate the redirectTo input on the server side, ensuring it points to a legitimate internal URL before performing the redirect.

Generated by OpenCVE AI on May 8, 2026 at 23:21 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-g7gw-m874-7rmf	Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.312% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf

History

May 12, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 8, 2026 11:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Akuity Akuity kargo
Vendors & Products		Akuity Akuity kargo

May 8, 2026 10:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
Title		Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Weaknesses		CWE-601
References		https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N'}`