GO-2026-4516
NoneCVSS
—
EPSS
—
Published
Feb 23, 2026
CISA due date
—
The record
Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints in github.com/akuity/kargo
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/akuity/kargo | 1.7.0 | 1.7.8 |
| Go | github.com/akuity/kargo | 1.8.0-rc.1 | 1.8.11 |
| Go | github.com/akuity/kargo | 1.9.0-rc.1 | 1.9.3 |
Related vulnerabilities
- CVE-2026-27112 Kargo manages and automates the promotion of software artifacts. Same vulnerability
- GO-2026-4515 Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API… Also affects github.com/akuity/kargo
- CVE-2026-27111 Kargo manages and automates the promotion of software artifacts. Also affects github.com/akuity/kargo
- GO-2026-4385 Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access… Also affects github.com/akuity/kargo
- CVE-2026-24748 Kargo manages and automates the promotion of software artifacts. Also affects github.com/akuity/kargo