CVE-2026-24748: 
NixOS vulnerability analysis and mitigation

CVE-2026-24748 is an incorrect authorization vulnerability in Akuity Kargo, a Kubernetes-native continuous delivery tool that manages and automates software artifact promotion. The flaw affects the GetConfig() and RefreshResource() API endpoints, allowing unauthenticated users to access them by supplying any non-empty Bearer token value in the Authorization header, regardless of token validity. Affected versions include Kargo prior to 1.6.3, 1.7.0–1.7.6, and 1.8.0–1.8.6. The vulnerability was disclosed on January 27, 2026, and carries a CVSS v4 base score of 6.9 (Medium) and a CVSS v3.1 base score of 7.2 (High) (Github Advisory, Kargo Advisory).

The root cause is a flawed fallback in Kargo's token authentication logic (CWE-863: Incorrect Authorization). Most Kargo API endpoints back their operations with Kubernetes objects, so unrecognized tokens are forwarded to the Kubernetes API for validation. However, GetConfig() and RefreshResource() do not use Kubernetes-backed clients subject to this validation path, meaning any non-empty Bearer token bypassed authentication entirely and was treated as authorized. The fix, applied across three patch commits, adds an explicit verifyKubernetesToken() function that validates unrecognized tokens against the Kubernetes /api endpoint before granting access, and rejects non-JWT opaque tokens outright rather than passing them through (Kargo Advisory, Patch Commit).

Exploitation of the GetConfig() endpoint allows unauthenticated attackers to exfiltrate Kargo configuration data, including API endpoints and namespaces for connected Argo CD clusters. This reconnaissance data could enable follow-on attacks against those clusters or their workloads. Abuse of the RefreshResource() endpoint does not expose sensitive data but can be used to trigger continuous Kubernetes resource reconciliations in a loop, degrading the performance of the Kargo API and potentially slowing legitimate requests to the underlying Kubernetes API server (Github Advisory, Kargo Advisory).

No public proof-of-concept exploit code is known to exist, and there are no confirmed reports of in-the-wild exploitation as of the disclosure date (Kargo Advisory). The vulnerability was identified by security researchers and responsibly disclosed. The EPSS score is approximately 0.12% (31st percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or network-accessible Kargo API server instances running versions prior to 1.6.3, 1.7.7, or 1.8.7 using network scanning tools or by inspecting Kubernetes cluster ingress configurations.
2. Craft malicious request to GetConfig(): Send an HTTP/gRPC request to the Kargo API's GetConfig() endpoint, including an Authorization header with any non-empty Bearer token value (e.g., Authorization: Bearer anystring).
3. Receive configuration data: The server, lacking proper token validation for this endpoint, returns Kargo configuration data including Argo CD cluster API endpoints and namespace information.
4. Enumerate targets: Use the extracted cluster URLs and namespaces to map the connected Argo CD infrastructure for use in subsequent attacks against those clusters.
5. Optional DoS via RefreshResource(): Send repeated requests to the RefreshResource() endpoint with any non-empty Bearer token to trigger continuous Kubernetes resource reconciliation annotations, degrading API server performance (Kargo Advisory, Github Advisory).

• Network: Unexpected or repeated HTTP/gRPC requests to the Kargo API's GetConfig() or RefreshResource() endpoints from unauthenticated or unknown source IPs; requests with syntactically invalid or arbitrary Bearer token values in the Authorization header.
• Logs: Kargo API server access logs showing successful responses to GetConfig() or RefreshResource() calls from sources that are not recognized Kargo clients or service accounts; high-frequency requests to RefreshResource() from a single source.
• Kubernetes Events: Unusual volume of reconciliation annotations being set on Kubernetes resources (e.g., kargo.akuity.io/refresh) without corresponding legitimate user activity, potentially visible via kubectl get events or audit logs.

Upgrade Kargo to the patched versions: 1.6.3 (for 1.6.x branch), 1.7.7 (for 1.7.x branch), or 1.8.7 (for 1.8.x branch). There are no configuration-based workarounds available for this issue, making patching the only remediation path. As an interim measure, restrict network-level access to the Kargo API endpoints to authorized users and services only, and monitor API logs for suspicious Bearer token usage or unexpected RefreshResource request patterns (Kargo Advisory, Github Advisory).

The vulnerability was identified by security researchers and disclosed responsibly through GitHub's security advisory process by Kargo maintainer thomastaylor312. The advisory notes that almost all users were already on one of the three patched version branches at the time of disclosure, limiting the practical exposure window. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified.