Akuity Kargo: Privilege escalation via project-scoped RBAC API
Summary
Kargo, a platform for automating the promotion of software artifacts, contains two authorization flaws in its project-scoped RBAC API. An authenticated user who was delegated permission to manage a Project's Roles or ServiceAccounts can grant themselves or others permissions they do not hold, because changes are written with the API server's privileged credentials after only a coarse check. Successful exploitation can lead to Project-administrator access, disclosure of Project secrets and credentials (including Git, container-registry and Helm-registry credentials), and modification or deletion of Project resources. Escalation is limited to the affected Project, and default non-administrator roles are not affected; exploitation requires an administrator-created custom role with RBAC-management permissions and control of an account assigned to it.
Affected
- Kargo from 0.6.0 before 1.8.14
- Kargo from 1.9.0-rc.1 before 1.9.9
- Kargo from 1.10.0-rc.1 before 1.10.8
- Other release branches: Unknown.
Fixed in
- 1.8.14
- 1.9.9
- 1.10.8
Workaround
- Unknown.
Exploitation
- No confirmed exploitation in the wild found.
- No public proof of concept found.
- CISA KEV status: Unknown.
Our recommendation
- Identify all Kargo installations and upgrade to 1.8.14, 1.9.9 or 1.10.8 (or a later fixed release).
- Review administrator-created custom roles and who can edit Roles or ServiceAccounts in each Project.
- Review existing Role bindings for unexpected identities.
- Rotate Git, registry and Helm credentials stored in affected Projects if misuse is suspected or access was broader than intended.
- Confirm the official advisory and NVD record, as NVD status is Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wp4p-hr79-q4g8 github.com
- Kargo release v1.8.14 github.com
- Kargo release v1.9.9 github.com
- Kargo release v1.10.8 github.com
- Fix commit 19639678811b486bddb014dabb25397771f3941e github.com
- Fix commit 50d29c10153965114f903645c83eadbe7bf58d3f github.com
- Fix commit 5ab7c4216a4151f55ea8ef9ff3b9f884dd322578 github.com
- Fix commit 72fadd3600b35e6dce67042eb686720a48b45fa3 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:23.
Original description (NVD)
Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's `Roles` or `ServiceAccounts` confer permissions exceeding the user's own. A user authorized to edit `Roles` can create, replace, or add rules granting permissions not held by the user; a user authorized to edit a Role's ServiceAccount can bind an identity, including the user's own, to a more powerful Role. A Kargo Role comprises a `ServiceAccount, Role, and RoleBinding` in the Project namespace. Changes are written using the API server's broadly privileged credentials after only a coarse resource-kind edit check, rather than checking each permission being conferred. This permits escalation to Project-administrator access, disclosure of `Project Secrets` and credentials, and modification or deletion of Project resources. Stolen Git, container-registry, or Helm-registry credentials can extend confidentiality and integrity impacts to those external systems. Escalation remains limited to Projects where the attacker already has RBAC-management delegation and does not itself grant cluster-wide or cross-Project access. Default non-administrator roles do not permit these operations; exploitation requires an `administrator-created custom role` granting the relevant permissions and control of an account assigned that role. This issue is fixed in versions 1.8.14, 1.9.9, and 1.10.8.
NVD references (9)
- https://github.com/akuity/kargo/commit/19639678811b486bddb014dabb25397771f3941e
- https://github.com/akuity/kargo/commit/50d29c10153965114f903645c83eadbe7bf58d3f
- https://github.com/akuity/kargo/commit/5ab7c4216a4151f55ea8ef9ff3b9f884dd322578
- https://github.com/akuity/kargo/commit/72fadd3600b35e6dce67042eb686720a48b45fa3
- https://github.com/akuity/kargo/releases/tag/v1.10.8
- https://github.com/akuity/kargo/releases/tag/v1.11.0-rc.1
- https://github.com/akuity/kargo/releases/tag/v1.8.14
- https://github.com/akuity/kargo/releases/tag/v1.9.9
- https://github.com/akuity/kargo/security/advisories/GHSA-wp4p-hr79-q4g8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.