CVE-2026-27111

Kargo manages and automates the promotion of software artifacts. From v1.9.0 to v1.9.2, Kargo's authorization model includes a promote verb -- a non-standard Kubernetes "dolphin verb" -- that gates the ability to advance Freight through a promotion pipeline. This verb exists to separate the ability to manage promotion-related resources from the ability to trigger promotions, enabling fine-grained access control over what is often a sensitive operation. The promote verb is correctly enforced in Kargo's legacy gRPC API. However, three endpoints in the newer REST API omit this check, relying only on standard Kubernetes RBAC for the underlying resource operations (patch on freights/status or create on promotions). This permits users who hold those standard permissions -- but who were deliberately not granted promote -- to bypass the intended authorization boundary. The affected endpoints are /v1beta1/projects/{project}/freight/{freight}/approve, /v1beta1/projects/{project}/stages/{stage}/promotions, and /v1beta1/projects/{project}/stages/{stage}/promotions/downstream. This vulnerability is fixed in v1.9.3.

• CWE-862

• https://github.com/akuity/kargo/commit/833314cad5513d48d89431493325ae44c1324a49Patch
• https://github.com/akuity/kargo/security/advisories/GHSA-5vvm-67pj-72g4Vendor Advisory

Published

Feb 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2710Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-27100Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts R…4.3
• CVE-2026-27101Dell Secure Connect Gateway (SCG) 5.0 Appliance and Applicat…7.2
• CVE-2026-27102Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and…7.8
• CVE-2026-27105Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, c…7.1
• CVE-2026-2711A vulnerability has been found in zhutoutoutousan worldquant…5.6
• CVE-2026-27112Kargo manages and automates the promotion of software artifa…9.9
• CVE-2026-27113Liquid Prompt is an adaptive prompt for Bash and Zsh. Starti…6.3
• CVE-2026-27114NanaZip is an open source file archive. Starting in version …7.5
• CVE-2026-27115ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9…7.1
• CVE-2026-27116Vikunja is an open-source self-hosted task management platfo…6.1
• CVE-2026-27117bit7z is a cross-platform C++ static library that allows the…7.5