CVE-2026-42350
Received Received - Intake
Open Redirect Vulnerability in Kargo UI OIDC Login Flow

Publication date: 2026-05-08

Last updated on: 2026-05-08

Assigner: GitHub, Inc.

Description
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-08
Last Modified
2026-05-08
Generated
2026-06-19
AI Q&A
2026-05-09
EPSS Evaluated
2026-06-18
NVD
CVE-2026-42350
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
kargo kargo to 1.10.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, upgrade Kargo to one of the patched versions: 1.7.10, 1.8.13, 1.9.8, or 1.10.2.

Impact Analysis

The open redirect vulnerability can be exploited to redirect users to potentially harmful external websites during the login process. This can lead to phishing attacks, where users might be tricked into providing sensitive information or downloading malicious content.

Executive Summary

This vulnerability affects Kargo software versions prior to 1.7.10, 1.8.13, 1.9.8, and 1.10.2. It is an open redirect issue in the UI OIDC login flow caused by improper handling of the redirectTo query parameter. An attacker could exploit this to redirect users to malicious sites.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42350. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart