CVE-2026-32828
2 advisories.
Go/github.com/akuity/kargo CVE-2026-32828: medium
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
Action: Upgrade github.com/akuity/kargo to 1.6.4 or later.
go get github.com/akuity/kargo@v1.6.4go get github.com/akuity/kargo@v1.7.9go get github.com/akuity/kargo@v1.8.12go get github.com/akuity/kargo@v1.9.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.4.0 | 1.6.4 | - |
| 1.7.0-rc.1 | 1.7.9 | - |
| 1.8.0-rc.1 | 1.8.12 | - |
| 1.9.0-rc.1 | 1.9.5 | - |
Fixed versions
| 1.6.4 | 1.7.9 | 1.8.12 | 1.9.5 |
Sources
- osv: GHSA-j94x-8wcp-x7hm
- https://github.com/akuity/kargo/security/advisories/GHSA-j94x-8wcp-x7hm
- https://nvd.nist.gov/vuln/detail/CVE-2026-32828
- https://github.com/akuity/kargo/commit/fd25620c2473ed19bec4be4d0f181287ef0f0391
- https://github.com/akuity/kargo
CVE-2026-32828 · published · modified · JSON
Go/github.com/akuity/kargo CVE-2026-32828: unknown
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration in github.com/akuity/kargo
Action: Upgrade github.com/akuity/kargo to 1.6.4 or later.
go get github.com/akuity/kargo@v1.6.4go get github.com/akuity/kargo@v1.7.9go get github.com/akuity/kargo@v1.8.12go get github.com/akuity/kargo@v1.9.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.4.0 | 1.6.4 | - |
| 1.7.0-rc.1 | 1.7.9 | - |
| 1.8.0-rc.1 | 1.8.12 | - |
| 1.9.0-rc.1 | 1.9.5 | - |
Fixed versions
| 1.6.4 | 1.7.9 | 1.8.12 | 1.9.5 |
Sources
- osv: GO-2026-4717
- https://github.com/akuity/kargo/security/advisories/GHSA-j94x-8wcp-x7hm
- https://nvd.nist.gov/vuln/detail/CVE-2026-32828
- https://github.com/akuity/kargo/commit/fd25620c2473ed19bec4be4d0f181287ef0f0391
CVE-2026-32828 · published · modified · JSON