CVE-2026-42350 Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Attackers can redirect users to malicious sites during OIDC login via the redirectTo parameter, potentially facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42350?
CVE-2026-42350 is a medium-severity vulnerability in akuity kargo, published on 8 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
Weakness: CWE-601
Which versions are affected by CVE-2026-42350?
9 open source packages ship an affected version, including github.com/akuity/kargo.
| Package | Affected | Fixed in |
|---|---|---|
github.com/akuity/kargo Go | All versions | 1.7.10, 1.8.13, 1.9.8, 1.10.2 |
github.com/akuity/kargo Go | All versions | 1.7.10 |
github.com/akuity/kargo Go | All versions | 1.7.10 |
github.com/akuity/kargo Go | From 1.10.0 | 1.10.2 |
github.com/akuity/kargo Go | From 1.10.0 | 1.10.2 |
github.com/akuity/kargo Go | From 1.8.0 | 1.8.13 |
3 more packages
github.com/akuity/kargo Go | From 1.8.0 | 1.8.13 |
github.com/akuity/kargo Go | From 1.9.0 | 1.9.8 |
github.com/akuity/kargo Go | From 1.9.0 | 1.9.8 |
How do I fix CVE-2026-42350?
Upgrade github.com/akuity/kargo to a fixed version for your release line: 1.7.10, 1.8.13, 1.9.8 or 1.10.2.
Is CVE-2026-42350 being exploited?
There is no known exploitation of CVE-2026-42350 in the wild and no public exploit code.
Sources
Also known as GHSA-g7gw-m874-7rmf, GO-2026-6301.