CVE-2026-27111
Authorization Bypass in Kargo REST API Allows Promotion Escalation
Publication date: 2026-02-20
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| akuity | kargo | From 1.9.0 (inc) to 1.9.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Kargo versions 1.9.0 to 1.9.2 and involves the authorization model for promoting software artifacts. Kargo uses a special 'promote' verb to control who can advance Freight through a promotion pipeline, which is a sensitive operation. While this promote verb is properly enforced in the legacy gRPC API, three endpoints in the newer REST API fail to enforce this check. Instead, they rely only on standard Kubernetes RBAC permissions, which allows users who have standard permissions but were not granted the promote verb to bypass the intended authorization controls and perform promotion actions they should not be allowed to.
- The affected REST API endpoints are: /v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream.
This issue was fixed in Kargo version 1.9.3.
How can this vulnerability impact me? :
This vulnerability can allow users who do not have explicit permission to promote software artifacts to bypass authorization controls and perform promotion actions. This could lead to unauthorized advancement of software through the promotion pipeline, potentially resulting in unapproved or malicious software being deployed or released.
Such unauthorized promotions can undermine the integrity of the software delivery process, increase the risk of introducing vulnerabilities or unstable code into production environments, and compromise the overall security posture of the organization.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Kargo to version 1.9.3 or later, where the authorization checks for the promote verb in the REST API endpoints have been fixed.