SZB-3025e503b0
EUVD-2026-114371 reports two authorization flaws in Kargo project-scoped RBAC API
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Akuity
- Product
- Kargo
- First seen
Summary
The EUVD listing says that in Kargo versions from 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the project-scoped RBAC API let an authenticated user with delegated permissions escalate access. It assigns a CVSS v3.1 score of 9.3.
If you use Akuity
Upgrade Kargo to 1.8.14, 1.9.9, 1.10.8, or a later release
Review delegated Project role-management permissions
Audit recent Role and RoleBinding changes in Kargo projects
What the sources say 1
· Mastodon: “From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's `Role...” Source