Detections
Analytics

SCA: security update for github.com/akuity/kargo (GHSA-w5wv-wvrp-v5m5)

medium Tenable Self-Hosted Container Security Plugin ID 437377

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and
 1.6.3, a bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed
 unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-empty
 `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of
 configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to
 enumerate cluster URLs and namespaces for use in subsequent attacks. Additionally, the same bug affected
 the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be
 used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API.
 `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run
 on a constant loop, this could also slow down legitimate requests to the Kubernetes API server. This
 problem has been patched in Kargo versiosn 1.8.7, 1.7.7, and 1.6.3. There are no workarounds for this
 issue. (CVE-2026-24748)

See Also

https://github.com/advisories/GHSA-w5wv-wvrp-v5m5

Plugin Details

Severity: Medium

ID: 437377

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 1/29/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2026-24748

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/27/2026

Vulnerability Publication Date: 1/27/2026

Reference Information

CVE: CVE-2026-24748

cwe: CWE-863