CVE-2026-42350
Open Redirect Vulnerability in Kargo UI OIDC Login Flow
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kargo | kargo | to 1.10.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Kargo software versions prior to 1.7.10, 1.8.13, 1.9.8, and 1.10.2. It is an open redirect issue in the UI OIDC login flow caused by improper handling of the redirectTo query parameter. An attacker could exploit this to redirect users to malicious sites.
How can this vulnerability impact me? :
The open redirect vulnerability can be exploited to redirect users to potentially harmful external websites during the login process. This can lead to phishing attacks, where users might be tricked into providing sensitive information or downloading malicious content.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Kargo to one of the patched versions: 1.7.10, 1.8.13, 1.9.8, or 1.10.2.