CVE-2026-24748

High

Published: 27 January 2026

Published

27 January 2026

Modified

25 February 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

EPSS Score 0.0010 27.8th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24748 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Akuity Kargo. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures

addresses: CWE-863

Periodic review and update of procedures reduces incorrect authorization implementations over time.

AC-13 Supervision and Review — Access Control

addresses: CWE-863

Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.

AC-16 Security and Privacy Attributes

addresses: CWE-863

Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.

AC-17 Remote Access

addresses: CWE-863

The authorization process and usage restrictions help prevent incorrect authorization for remote access types.

AC-18 Wireless Access

addresses: CWE-863

Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.

AC-19 Access Control for Mobile Devices

addresses: CWE-863

Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.

AC-2 Account Management

addresses: CWE-863

Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.

AC-20 Use of External Systems

addresses: CWE-863

Ensures authorization decisions for external system use are correctly implemented and enforced.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1018 Remote System Discovery Discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

attack.mitre.org →

T1499 Endpoint Denial of Service Impact

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

attack.mitre.org →

Why these techniques?

Authentication bypass on public Kargo API directly enables T1190 for initial exploitation, T1005 for config data exfiltration, T1018 for cluster/namespace enumeration, and T1499 for DoS via RefreshResource loops.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization`…

header with any non-empty `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue.

Deeper analysisAI

CVE-2026-24748 is a vulnerability in Kargo, an open-source tool for managing and automating the promotion of software artifacts in Kubernetes environments. In versions prior to 1.8.7, 1.7.7, and 1.6.3, flawed authentication checks on the GetConfig() API endpoint allow unauthenticated access when an arbitrary non-empty Bearer token is provided in the Authorization header, bypassing proper validation. The same issue affects the RefreshResource endpoint, enabling unauthorized interactions without information disclosure on that endpoint alone.

Network-accessible unauthenticated attackers can exploit GetConfig() to exfiltrate sensitive configuration data, including endpoints for connected Argo CD clusters, which may facilitate enumeration of cluster URLs and namespaces for follow-on attacks. Exploitation of RefreshResource allows triggering reconciliations by annotating Kubernetes resources, potentially enabling a denial-of-service condition if repeated in a loop, thereby degrading performance of the Kargo API and legitimate requests to the Kubernetes API server. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) and is associated with CWE-863 (Incorrect Authorization).

The issue has been addressed in Kargo versions 1.8.7, 1.7.7, and 1.6.3 via fixes documented in specific GitHub commits and the project's security advisory (GHSA-w5wv-wvrp-v5m5). No workarounds are available.