{"vulnerability": "CVE-2026-42350", "sightings": [{"uuid": "3d5baa4b-48b2-4392-8dce-d5f3fe54b48d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42350", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116545697527370018", "content": "A lot of offensive activities were identified targeting akuity kargo (CVE-2026-42350) https://vuldb.com/vuln/362396/cti", "creation_timestamp": "2026-05-09T17:03:37.111826Z"}, {"uuid": "01327f27-86d4-47c7-868b-099181686ed1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42350", "type": "seen", "source": "https://gist.github.com/alon710/14e4e76cd8061b293a52482e75942e6f", "content": "# CVE-2026-42350: CVE-2026-42350: Client-Side Open Redirect in Kargo UI OIDC Authentication Flow\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-42350\n\n## Summary\nA client-side open redirect vulnerability has been identified in the Kargo user interface. The flaw resides in the handling of OpenID Connect (OIDC) login and token renewal flows, where the application extracts an unvalidated destination path from the redirectTo query parameter. Attackers can exploit this to redirect authenticated users to arbitrary external domains.\n\n## TL;DR\nKargo UI allowed client-side open redirects via unvalidated query parameters after OIDC login or token renewal, enabling phishing attacks. The issue is fixed in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.\n\n## Technical Details\n\n- **CWE ID**: CWE-601\n- **Attack Vector**: Network\n- **CVSS v4.0**: 5.1 (Medium)\n- **EPSS Score**: 0.00239 (Percentile: 14.83%)\n- **Exploit Maturity**: Theoretical / None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Kargo UI OIDC authentication flows\n- Kargo UI Token Renewal interface\n- Kargo UI Login interface\n- **Kargo**: < 1.7.10 (Fixed in: `1.7.10`)\n- **Kargo**: >= 1.8.0-rc.1, < 1.8.13 (Fixed in: `1.8.13`)\n- **Kargo**: >= 1.9.0-rc.1, < 1.9.8 (Fixed in: `1.9.8`)\n- **Kargo**: >= 1.10.0-rc.1, < 1.10.2 (Fixed in: `1.10.2`)\n\n## Mitigation\n\n- Upgrade Kargo to version 1.7.10, 1.8.13, 1.9.8, 1.10.2 or higher\n- Sanitize client-side redirect parameters at the reverse proxy or ingress level\n- Implement WAF validation rules to filter external paths in parameters\n\n**Remediation Steps:**\n1. Determine the current active deployment version of Kargo.\n2. Update Helm charts, Kustomize manifests, or deployment templates to refer to the corresponding fixed versions.\n3. Apply the configuration changes to the cluster to trigger container replacement.\n4. Verify the application of the patch by testing redirection endpoints with protocol-relative URLs.\n\n## References\n\n- [GitHub Security Advisory GHSA-g7gw-m874-7rmf](https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf)\n- [NVD - CVE-2026-42350](https://nvd.nist.gov/vuln/detail/CVE-2026-42350)\n- [CVE Record - CVE-2026-42350](https://www.cve.org/CVERecord?id=CVE-2026-42350)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-42350) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T21:32:59.700943Z"}]}