Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-09 | 3 | Active Exploitation1Disclosure1General1 |
| 2026-08-27 | 1 | Disclosure1 |
A lot of offensive activities were identified targeting akuity kargo (CVE-2026-42350) https://vuldb.com/vuln/362396/cti
Post summary
The tweet reports that multiple offensive operations have been detected against CVE‑2026‑42350, indicating active exploitation in the wild, but offers no PoC, exploit code, patch, or detailed technical information.
🔵 Kargo, Open Redirect, #CVE-2026-42350 (Low) -DC-Aug2026-1968 https://dailycve.com/kargo-open-redirect-cve-2026-42350-low-dc-aug2026-1968/
Post summary
The post announces the low‑severity open redirect vulnerability CVE‑2026‑42350 in Kargo; no PoC, exploit, active usage, or patching information is provided.
CVE-2026-42350 Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC … https://www.cve.org/CVERecord?id=CVE-2026-42350
Post summary
An open redirect vulnerability (CVE‑2026‑42350) was disclosed affecting Kargo versions prior to 1.7.10, 1.8.13, 1.9.8 and 1.10.2.
CVE-2026-42350 Open Redirect in Kargo UI OIDC Login Flow Prior to Versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42350
Post summary
A brief reference to CVE-2026-42350 is provided, noting an open redirect flaw in Kargo UI OIDC Login Flow before certain versions, without mentioning PoC, exploit, or patch details.