CVE-2026-27112: 
NixOS vulnerability analysis and mitigation

CVE-2026-27112 is an authorization bypass vulnerability in Kargo's batch resource creation API endpoints, classified as "Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints." It affects Kargo versions 1.7.0–1.7.7, 1.8.0–1.8.10, and 1.9.0–1.9.2, a GitOps continuous delivery tool for Kubernetes maintained by Akuity. The vulnerability was published on February 20, 2026, with patches released on February 17, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) and a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, Feedly).

The root cause is a logic bug (CWE-863: Incorrect Authorization) in the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API, which accept multi-document YAML payloads. When a Project resource is created, subsequent resources in the same payload are processed using the API server's own elevated permissions — a design intended to avoid a race condition with asynchronous permission grants. However, a missing error-check condition (err == nil) allowed this elevated-permission code path to be triggered even when Project creation failed, enabling injection of arbitrary resources into the namespace of an existing Project using the API server's permissions (GitHub Advisory, Patch Commit). The fix adds err == nil guards in create_resource_v1alpha1.go, create_or_update_resource_v1alpha1.go, and update_resource_v1alpha1.go to ensure elevated permissions are only used when Project creation actually succeeds (Patch Commit).

A low-privileged authenticated attacker can exploit this vulnerability to inject arbitrary resources (e.g., RoleBindings) into existing Kargo Project namespaces using the API server's own permissions, effectively escalating their privileges to administrator level. This privilege escalation can then be leveraged to achieve remote code execution, exfiltrate Kubernetes secrets, or steal artifact repository credentials stored in Project namespaces. Exfiltrated credentials — which often include write access to GitOps repositories — can be used to tamper with downstream infrastructure, impacting the confidentiality, integrity, and availability of both the Kargo control plane and its underlying Kubernetes cluster, as well as any subsequent systems managed through those repositories (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory, Feedly). The vulnerability requires authentication to the Kargo API server — anonymous access is not sufficient — but only low-level permissions typically granted to all Kargo users are needed. The EPSS score is 0.00205 (approximately 0.2%), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The advisory notes that the most severe privilege escalation path (via RoleBinding injection) was not immediately obvious to the original reporter, suggesting some exploitation complexity (GitHub Advisory).

1. Authenticate to Kargo API: Obtain valid low-privilege credentials for the Kargo API server (e.g., a standard user account with basic permissions granted to all Kargo users).
2. Identify target Project: Enumerate existing Kargo Projects to identify a target namespace into which resources will be injected.
3. Craft malicious multi-document YAML payload: Construct a multi-document YAML payload where the first document attempts to create a Project with a name that already exists (causing creation to fail), followed by one or more documents defining privileged resources (e.g., a RoleBinding granting the attacker admin-level permissions) targeting the existing Project's namespace.
4. Submit payload to batch endpoint: Send the crafted payload to either the legacy gRPC CreateResource or CreateOrUpdateResource endpoint, or the newer REST API equivalent. Due to the missing err == nil check, the API server proceeds to create subsequent resources using its own elevated permissions despite the Project creation failure.
5. Escalate privileges: The injected RoleBinding grants the attacker elevated permissions within the target Project namespace.
6. Exfiltrate secrets or achieve RCE: Use the escalated permissions to read Kubernetes secrets (artifact repository credentials, GitOps repository tokens) or, in permissive cluster configurations, execute commands via kubectl to achieve remote code execution.
7. Lateral movement: Use exfiltrated credentials to push malicious configurations to GitOps repositories, affecting downstream systems managed by Kargo (GitHub Advisory, Patch Commit).

• Network: Unusual HTTP/gRPC requests to Kargo batch resource creation endpoints (CreateResource, CreateOrUpdateResource) containing multi-document YAML payloads; requests where the first document references an already-existing Project name.
• Logs: Kargo API server logs showing failed Project creation immediately followed by successful resource creation in an existing Project's namespace; unexpected RoleBinding or ClusterRoleBinding creation events in Kubernetes audit logs attributed to the Kargo API server service account.
• Kubernetes Resources: Unexpected RoleBindings or other authorization resources appearing in Project namespaces not created through normal administrative workflows; new service accounts or RBAC resources with elevated permissions tied to low-privilege user identities.
• Secrets Access: Kubernetes audit logs showing reads of Secrets in Project namespaces by accounts that should not have access; unexpected access to artifact repository credentials or GitOps tokens.
• GitOps Repositories: Unauthorized commits or configuration changes pushed to GitOps repositories using credentials stored in Kargo Project secrets.

Upgrade Kargo to the patched versions: v1.7.8, v1.8.11, or v1.9.3, depending on the currently deployed branch (GitHub Advisory). As interim mitigations, restrict network access to Kargo API endpoints to trusted networks only, implement least-privilege access controls for API credentials, and monitor batch resource creation API calls for suspicious multi-document YAML payloads. After patching, audit all resources created through API endpoints during the vulnerability window (Kargo versions 1.7.0–1.7.7, 1.8.0–1.8.10, 1.9.0–1.9.2) for unauthorized RoleBindings or other injected resources (Feedly).

The vulnerability was reported by researchers identified as b0b0haha and spingARbor, and coordinated by Kargo maintainer krancour (GitHub Advisory). Red Hat published a security advisory tracking the CVE, and SUSE's govulncheck vulnerability database also flagged the issue (Red Hat, Linux Security). Community discussion was noted on Mastodon/infosec.exchange and security aggregators including Vulners and VulDB, reflecting moderate industry attention given the critical severity score.