Medium
Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Type: advisorySources: OSV
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-42350
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 02:44 UTC · Revision 1
Source evidence
Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
core-osv · Original sourcePublished 8 May 2026, 22:35 UTC
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
osv:CVE-2026-42350
Complete source record
{
"id": "433c35d3243b175631faed07d0c6187905fc492614a36f4ae0d5f77be18054a9",
"url": "https://osv.dev/vulnerability/CVE-2026-42350",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter",
"summary": "Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.",
"evidence": "osv:CVE-2026-42350",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-42350",
"aliases": [
"CVE-2026-42350",
"GHSA-g7gw-m874-7rmf",
"GO-2026-6301"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/akuity/kargo",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "2c8f95efe19d6edc3a416b384b3138885cf4bc31"
},
{
"introduced": "ccd41e14522b722e6d7e7253db0432775e03006d"
},
{
"fixed": "50df4b3dfc6e0619553c3bccf70356572b03d7dd"
},
{
"introduced": "43f0d467c3fd15fe4386f184f4cc757d747be041"
},
{
"fixed": "52107be1d392feaf02d640083cc000be5756f557"
},
{
"introduced": "5413c5e4729ba32bf5f4eadefd9584c1ad44e3fe"
},
{
"fixed": "768b2a62dcd70b7b2313290fea6c673e49e0c2d4"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.7.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "1.8.0-rc.1"
},
{
"fixed": "1.8.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "1.9.0-rc.1"
},
{
"fixed": "1.9.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "1.10.0-rc.1"
},
{
"fixed": "1.10.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
}
],
"versions": [
"v1.9.7",
"v1.8.12",
"v1.7.9",
"v1.10.1",
"v1.10.0-rc.8",
"v1.10.0",
"v1.10.0-rc.7",
"v1.10.0-rc.6",
"v1.10.0-rc.5",
"v1.10.0-rc.4",
"v1.10.0-rc.3",
"v1.9.6",
"v1.10.0-rc.2",
"v1.10.0-rc.1",
"v1.9.5",
"v1.7.8",
"v1.8.11",
"v1.9.4",
"v1.9.3",
"v1.7.7",
"v1.8.10",
"v1.9.2",
"v1.9.1",
"v1.8.9",
"v1.9.0",
"v1.9.0-rc.2",
"v1.8.8",
"v1.8.7",
"v1.9.0-rc.1",
"v1.8.6",
"v1.8.5",
"v1.8.4",
"v1.8.3",
"v1.8.2",
"v1.8.1",
"v1.7.6",
"v1.8.0-rc.7",
"v1.8.0",
"v1.8.0-rc.6",
"v1.8.0-rc.5",
"v1.8.0-rc.4",
"v1.8.0-rc.3",
"v1.8.0-rc.2",
"v1.8.0-rc.1",
"v1.7.5",
"v1.7.4",
"v1.7.3",
"v1.7.2",
"v1.7.1",
"v1.7.0",
"v1.7.0-rc.3",
"v1.7.0-rc.2",
"v1.7.0-rc.1",
"v1.6.0-rc.1",
"v1.5.0-rc.1",
"v1.4.0-rc.1",
"v1.2.0-rc.1",
"v1.2.0-soak-time-preview",
"v1.1.2-rc.1",
"v1.1.0-rc.2",
"v1.1.0-rc.1",
"v1.0.0-rc.5",
"v1.0.0",
"v1.0.0-rc.4",
"v1.0.0-rc.3",
"v1.0.0-rc.2",
"v1.0.0-rc.1",
"v0.8.0-rc.1",
"v0.7.1",
"v0.7.0-rc.1",
"v0.6.0-rc.1",
"v0.5.0-rc.1",
"v0.4.0-rc.1",
"v0.3.0-rc.1",
"v0.3.0-alpha.1",
"v0.2.0-rc.2",
"v0.2.0",
"v0.2.0-rc.1",
"v0.1.1-rc.2",
"v0.1.1-rc.1",
"v0.1.0",
"v0.1.0-rc.24",
"v0.1.0-rc.23",
"v0.1.0-rc.22",
"v0.1.0-rc.21",
"v0.1.0-rc.20",
"v0.1.0-rc.19",
"v0.1.0-rc.18",
"v0.1.0-rc.17",
"v0.1.0-rc.16",
"v0.1.0-rc.15",
"v0.1.0-rc.14",
"v0.1.0-rc.13",
"v0.1.0-rc.12",
"v0.1.0-rc.11",
"v0.1.0-rc.10",
"v0.1.0-rc.9",
"v0.1.0-rc.8",
"v0.1.0-rc.7",
"v0.1.0-rc.6",
"v0.1.0-rc.5",
"v0.1.0-rc.4",
"v0.1.0-rc.3",
"v0.1.0-rc.2",
"v0.1.0-rc.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42350.json"
}
}
],
"modified": "2026-10-28T02:30:25.139817339Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42350.json",
"https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf",
"https://nvd.nist.gov/vuln/detail/CVE-2026-42350"
],
"provider_metadata": {
"cwe_ids": [
"CWE-601"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42350.json"
}
},
"related_cves": [
{
"value": "CVE-2026-42350",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491957,
"published_at": "2026-05-08T22:35:30.155+00:00"
}