CVE-2026-61850

Name of the Vulnerable Software and Affected Versions Kargo versions 0.6.0 through 1.8.13 Kargo versions 1.9.0 through 1.9.8 Kargo versions 1.10.0 through 1.10.7

Description Two authorization flaws in the project-scoped RBAC API allow an authenticated user with delegated permissions to manage a Project's Roles or ServiceAccounts to grant permissions that exceed their own. A user authorized to edit Roles can create or modify rules to grant unauthorized permissions, while a user authorized to edit a Role's ServiceAccount can bind an identity to a more powerful Role. This occurs because the API server uses broadly privileged credentials and performs only a coarse resource-kind edit check instead of verifying each conferred permission. This can lead to escalation to Project-administrator access, disclosure of Project Secrets and credentials, and the modification or deletion of Project resources. Furthermore, stolen Git, container-registry, or Helm-registry credentials may impact the confidentiality and integrity of external systems. Exploitation requires an administrator-created custom role granting these specific permissions and control of an account assigned to that role, and is limited to Projects where the attacker already has RBAC-management delegation.

Recommendations Update to version 1.8.14 Update to version 1.9.9 Update to version 1.10.8