CVE-2026-24748
Published: 27 January 2026
Summary
CVE-2026-24748 is a medium-severity Incorrect Authorization (CWE-863) vulnerability in Akuity Kargo. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-24748 is a vulnerability in Kargo, an open-source tool for managing and automating the promotion of software artifacts in Kubernetes environments. In versions prior to 1.8.7, 1.7.7, and 1.6.3, flawed authentication checks on the GetConfig() API endpoint allow unauthenticated access when an arbitrary non-empty Bearer token is provided in the Authorization header, bypassing proper validation. The same issue affects the RefreshResource endpoint, enabling unauthorized interactions without information disclosure on that endpoint alone.
Network-accessible unauthenticated attackers can exploit GetConfig() to exfiltrate sensitive configuration data, including endpoints for connected Argo CD clusters, which may facilitate enumeration of cluster URLs and namespaces for follow-on attacks. Exploitation of RefreshResource allows triggering reconciliations by annotating Kubernetes resources, potentially enabling a denial-of-service condition if repeated in a loop, thereby degrading performance of the Kargo API and legitimate requests to the Kubernetes API server. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) and is associated with CWE-863 (Incorrect Authorization).
The issue has been addressed in Kargo versions 1.8.7, 1.7.7, and 1.6.3 via fixes documented in specific GitHub commits and the project's security advisory (GHSA-w5wv-wvrp-v5m5). No workarounds are available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4736
Vulnerability details
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization`…
more
header with any non-empty `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authentication bypass on public Kargo API directly enables T1190 for initial exploitation, T1005 for config data exfiltration, T1018 for cluster/namespace enumeration, and T1499 for DoS via RefreshResource loops.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces valid authorization decisions on API endpoints such as GetConfig() and RefreshResource, blocking the Bearer-token bypass that allows unauthenticated access.
Requires that only the minimum privileges needed are granted, so the flawed authorization logic would not have permitted any access without explicit, valid credentials.
Limits the ability of unauthenticated callers to trigger repeated RefreshResource reconciliations that degrade Kargo and Kubernetes API performance.