Authentication Bug in Kargo Affects API Endpoints and Exposes Configuration Data
CVE-2026-24748
What is CVE-2026-24748?
A vulnerability in Kargo allows unauthenticated users to exploit the GetConfig() API endpoint by providing any non-empty Bearer token, leading to unauthorized access to sensitive configuration data. This data includes critical endpoints for Argo CD clusters, potentially enabling attackers to enumerate cluster URLs and namespaces for further attacks. Additionally, the RefreshResource API endpoint, although not revealing sensitive information, could be exploited by an attacker to perform denial-of-service tactics through constant invocation, impacting legitimate service operations. The issue has been addressed in Kargo versions 1.8.7, 1.7.7, and 1.6.3.
Affected Version(s)
kargo < 1.6.3 < 1.6.3
kargo >= 1.7.0, < 1.7.7 < 1.7.0, 1.7.7
kargo <= 1.8.0, < 1.8.7 < 1.8.0, 1.8.7