{"action":"Upgrade github.com/akuity/kargo to 1.7.10 or later.","affected":[{"fixed":"1.7.10","introduced":"0"},{"fixed":"1.8.13","introduced":"1.8.0"},{"fixed":"1.9.8","introduced":"1.9.0"},{"fixed":"1.10.2","introduced":"1.10.0"}],"component":"github.com/akuity/kargo","cve_ids":["CVE-2026-42350"],"ecosystem":"Go","epss":0.00312,"exploited":false,"fixed_versions":["1.7.10","1.8.13","1.9.8","1.10.2"],"ghsa_id":"GHSA-g7gw-m874-7rmf","id":"tcs_01M5KGT3KWWMZQ7FT44W97GR0Z","modified_at":"2026-08-27T20:15:15.825726788Z","published_at":"2026-08-27T19:52:28Z","references":["https://osv.dev/vulnerability/GO-2026-6301","https://github.com/akuity/kargo/security/advisories/GHSA-g7gw-m874-7rmf","https://nvd.nist.gov/vuln/detail/CVE-2026-42350","https://github.com/akuity/kargo/commit/0b89215740e93d18f1ab2187f6f9733137f9d00f","https://github.com/akuity/kargo/commit/52107be1d392feaf02d640083cc000be5756f557","https://github.com/akuity/kargo/commit/768b2a62dcd70b7b2313290fea6c673e49e0c2d4","https://github.com/akuity/kargo/commit/d2c8d185b7cc43e225e0e2d17937511820479834","https://github.com/akuity/kargo/commit/db8ca6c015defc5ea29afb32cdea982b657f263a","https://github.com/akuity/kargo/releases/tag/v1.10.2","https://github.com/akuity/kargo/releases/tag/v1.7.10","https://github.com/akuity/kargo/releases/tag/v1.8.13","https://github.com/akuity/kargo/releases/tag/v1.9.8"],"severity":{"label":"medium","score":5.1},"sources":[{"source":"osv","source_id":"GO-2026-6301","url":"https://osv.dev/vulnerability/GO-2026-6301"},{"source":"nvd","source_id":"CVE-2026-42350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42350"}],"summary":"Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo"}