Research · Feb 20, 2026 · ZeroDay Catalog
Critical Vulnerability in Kargo APIs Allows Unauthorized Resource Injection
A significant vulnerability has been identified in Kargo's API endpoints, enabling unauthorized resource injection and potential privilege escalation.
What changed
Kargo has a critical vulnerability affecting its batch resource creation endpoints in both the legacy gRPC API and the newer REST API. This issue is present in versions from 1.7.0 up to, but not including, v1.7.8, v1.8.11, and v1.9.3.
The vulnerability arises from the acceptance of specially crafted multi-document YAML payloads, which can exploit a flaw in the logic of these endpoints.
- Arbitrary resources can be injected into the namespace of an existing project.
- This behavior occurs using the API server's own permissions, which was not intended.
- The flaw can be exploited to elevate an attacker's permissions within the system.
Who is affected
Organizations utilizing Kargo for managing and automating software artifacts are at risk due to this vulnerability. The following groups should be particularly vigilant:
Users of Kargo versions 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3 are directly impacted.
- Development teams relying on Kargo for CI/CD processes.
- Companies using Kargo for software artifact promotion.
- Organizations with sensitive projects that could be compromised through privilege escalation.
What to do
It is imperative for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Users should consider the following steps:
Upgrade to the latest versions of Kargo that are not affected by this vulnerability.
- Monitor for any unusual activity within your Kargo-managed projects.
- Review access permissions and ensure they align with the principle of least privilege.
- Implement additional security measures to safeguard against potential exploitation.