{"action":"Upgrade github.com/akuity/kargo to 1.6.3 or later.","affected":[{"fixed":"1.6.3","introduced":"0"},{"fixed":"1.7.7","introduced":"1.7.0-rc.1"},{"fixed":"1.8.7","introduced":"1.8.0-rc.1"}],"component":"github.com/akuity/kargo","cve_ids":["CVE-2026-24748"],"ecosystem":"Go","epss":0.00393,"exploited":false,"fixed_versions":["1.6.3","1.7.7","1.8.7"],"ghsa_id":"GHSA-w5wv-wvrp-v5m5","id":"tcs_01M5KGDFAP844J7RQ5FPWCPBG3","modified_at":"2026-03-03T04:57:54.887935Z","published_at":"2026-02-02T21:05:59Z","references":["https://osv.dev/vulnerability/GO-2026-4385","https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5","https://nvd.nist.gov/vuln/detail/CVE-2026-24748","https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772","https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7","https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GO-2026-4385","url":"https://osv.dev/vulnerability/GO-2026-4385"},{"source":"nvd","source_id":"CVE-2026-24748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24748"}],"summary":"Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access in github.com/akuity/kargo"}