{"action":"Upgrade github.com/akuity/kargo to 1.6.3 or later.","affected":[{"fixed":"1.6.3","introduced":"0"},{"fixed":"1.7.7","introduced":"1.7.0-rc.1"},{"fixed":"1.8.7","introduced":"1.8.0-rc.1"}],"component":"github.com/akuity/kargo","cve_ids":["CVE-2026-24748"],"ecosystem":"Go","epss":0.00393,"exploited":false,"fixed_versions":["1.6.3","1.7.7","1.8.7"],"ghsa_id":"GHSA-w5wv-wvrp-v5m5","id":"tcs_01M5KFQ84HZ3P6Q1YHZCHAXN9D","modified_at":"2026-02-03T03:05:42.143414Z","published_at":"2026-01-27T22:15:28Z","references":["https://osv.dev/vulnerability/GHSA-w5wv-wvrp-v5m5","https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5","https://nvd.nist.gov/vuln/detail/CVE-2026-24748","https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772","https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7","https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c","https://github.com/akuity/kargo"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-w5wv-wvrp-v5m5","url":"https://osv.dev/vulnerability/GHSA-w5wv-wvrp-v5m5"}],"summary":"Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access"}