GO-2026-4385
NoneCVSS
—
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access in github.com/akuity/kargo
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/akuity/kargo | 0 | 1.6.3 |
| Go | github.com/akuity/kargo | 1.7.0-rc.1 | 1.7.7 |
| Go | github.com/akuity/kargo | 1.8.0-rc.1 | 1.8.7 |
| go | github.com/akuity/kargo | 1.7.0-rc.1 | 1.7.7 |
| go | github.com/akuity/kargo | 1.8.0-rc.1 | 1.8.7 |
Related vulnerabilities
- CVE-2026-24748 Kargo manages and automates the promotion of software artifacts. Same vulnerability
- GO-2026-4515 Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API… Also affects github.com/akuity/kargo
- GO-2026-4516 Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints… Also affects github.com/akuity/kargo
- CVE-2026-27112 Kargo manages and automates the promotion of software artifacts. Also affects github.com/akuity/kargo
- CVE-2026-27111 Kargo manages and automates the promotion of software artifacts. Also affects github.com/akuity/kargo