CVE Intelligence
Analysis AI-assisted

CVE-2026-27112: Kargo Authorization Bypass in Batch Resource Creation API Endpoints

CVE-2026-27112 affects Akuity Kargo, where the batch resource creation endpoints of the legacy gRPC API and the REST API accept multi-document YAML payloads that can inject certain resource types into a Project namespace beyond the intended authorization. The vendor fixes are in 1.7.8, 1.8.11 and 1.9.3, and the record assigns a CVSS 3.1 score of 9.9 from NVD. The record reports no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Kargo is a platform for managing and automating the promotion of software artifacts. CVE-2026-27112 is classified as CWE-863 (Incorrect Authorization) and concerns the batch resource creation endpoints of both the legacy gRPC API and the newer REST API, which accept multi-document YAML payloads.

Impact

  • The record describes a case in which resources of specific types can be created in the namespace of an existing Project using the API server's own permissions, when this was not intended.
  • The vector in the record is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, meaning network access with low privileges required and high impact on confidentiality, integrity and availability.
  • The record states that the flaw may be used to elevate privileges, and that the result may include remote code execution or secret exfiltration, including artifact repository credentials.

Affected products and versions

  • Akuity Kargo from 1.7.0 up to before 1.7.8.
  • Akuity Kargo from 1.8.0 up to before 1.8.11.
  • Akuity Kargo from 1.9.0 up to before 1.9.3.

The fixed releases named in the record are v1.7.8, v1.8.11 and v1.9.3. The fix commit is listed in the GitHub commit reference.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. The record's SSVC data shows exploitation as none. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Upgrade Kargo to 1.7.8, 1.8.11 or 1.9.3, depending on the release line in use, as described in the vendor advisory.
  • Until patching is complete, review who holds permissions to create resources through the Kargo APIs and restrict those permissions to the minimum needed.
  • Review the permissions granted to the API server in the Kubernetes cluster that hosts the Kargo control plane, and rotate artifact repository credentials if exposure is suspected.

Detection guidance

  • Audit Kargo API activity for batch creation requests containing multi-document YAML, particularly those creating resource types in Project namespaces.
  • Monitor for unexpected resource creation within Project namespaces and for unexpected changes in permissions for Kargo service accounts.
  • Review access logs for the legacy gRPC API and the REST API around the time of any suspicious activity.

Limitations of the available information

The record does not describe the exact payload structure, the specific resource types affected, or the detection signatures. The configurations of the Kubernetes clusters that would make kubectl-based escalation possible are not specified. The record lists no active exploitation data beyond the absence of KEV listing and the SSVC value.

Frequently asked questions

Is CVE-2026-27112 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is none.

Which Kargo versions are fixed?

According to the record, the fixed releases are v1.7.8, v1.8.11 and v1.9.3, and the affected ranges begin at 1.7.0, 1.8.0 and 1.9.0 respectively.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.