📦 Kargo

This CVE describes an authentication bypass vulnerability in Kargo's API endpoints. Unauthenticated attackers can access configuration data (exposing Argo CD cluster details) and trigger resource refr...

Kargo versions 1.9.0 to 1.9.2 have an authorization bypass vulnerability where three REST API endpoints omit the 'promote' verb check. This allows users with standard Kubernetes RBAC permissions to tr...