CVE-2026-42350CWE-601

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Medium · published May 8, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00406 · 33.7th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-05-08T22:35Z
EPSS history
Timeline
  • 08 MAY 22:35Z
    Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
    cvelistv5