DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-42350: CVE-2026-42350: Client-Side Open Redirect in Kargo UI OIDC Authentication Flow

#security #cve #cybersecurity

CVE-2026-42350: Client-Side Open Redirect in Kargo UI OIDC Authentication Flow

Vulnerability ID: CVE-2026-42350
CVSS Score: 5.1
Published: 2026-08-27

A client-side open redirect vulnerability has been identified in the Kargo user interface. The flaw resides in the handling of OpenID Connect (OIDC) login and token renewal flows, where the application extracts an unvalidated destination path from the redirectTo query parameter. Attackers can exploit this to redirect authenticated users to arbitrary external domains.

TL;DR

Kargo UI allowed client-side open redirects via unvalidated query parameters after OIDC login or token renewal, enabling phishing attacks. The issue is fixed in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Technical Details

  • CWE ID: CWE-601
  • Attack Vector: Network
  • CVSS v4.0: 5.1 (Medium)
  • EPSS Score: 0.00239 (Percentile: 14.83%)
  • Exploit Maturity: Theoretical / None
  • CISA KEV Status: Not Listed

Affected Systems

  • Kargo UI OIDC authentication flows
  • Kargo UI Token Renewal interface
  • Kargo UI Login interface
  • Kargo: < 1.7.10 (Fixed in: 1.7.10)
  • Kargo: >= 1.8.0-rc.1, < 1.8.13 (Fixed in: 1.8.13)
  • Kargo: >= 1.9.0-rc.1, < 1.9.8 (Fixed in: 1.9.8)
  • Kargo: >= 1.10.0-rc.1, < 1.10.2 (Fixed in: 1.10.2)

Code Analysis

Commit: 0b89215

ui: fix open redirect vulnerability in oidc login

Commit: 52107be

ui: fix open redirect vulnerability in token renew

Commit: 768b2a6

ui: fix open redirect vulnerability in login page

Mitigation Strategies

  • Upgrade Kargo to version 1.7.10, 1.8.13, 1.9.8, 1.10.2 or higher
  • Sanitize client-side redirect parameters at the reverse proxy or ingress level
  • Implement WAF validation rules to filter external paths in parameters

Remediation Steps:

  1. Determine the current active deployment version of Kargo.
  2. Update Helm charts, Kustomize manifests, or deployment templates to refer to the corresponding fixed versions.
  3. Apply the configuration changes to the cluster to trigger container replacement.
  4. Verify the application of the patch by testing redirection endpoints with protocol-relative URLs.

References

Read the full report for CVE-2026-42350 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)