CVE-2026-27112: Critical Privilege Escalation in Kargo

CVE-2026-27112 is a critical (CVSS 9.9) authorization flaw in Kargo from 1.7.0 up to the fixed releases. Crafted multi document YAML sent to the batch resource creation endpoints can inject resources into a Project namespace using the API server's own permissions. Upgrade to 1.7.8, 1.8.11 or 1.9.3.

What's affected

Kargo from 1.7.0 and before v1.7.8, v1.8.11 and v1.9.3. Both the legacy gRPC API and the newer REST API batch creation endpoints are affected.

Fixed versions:

• 1.7.8 for the 1.7 line
• 1.8.11 for the 1.8 line
• 1.9.3 for the 1.9 line

How to check if you're exposed

Check the version of your Kargo control plane. If you installed with Helm, look at the release and chart version:

helm list -A | grep -i kargo

Any 1.7.x below 1.7.8, 1.8.x below 1.8.11 or 1.9.x below 1.9.3 is affected. Also list who holds API access to Projects, since the attack needs an account with some access to the API.

What to do now

1. Upgrade to 1.7.8, 1.8.11 or 1.9.3, whichever matches your release line.
2. Review who has permission to call the API and remove access that is not needed.
3. Check Project namespaces for resources you did not create, especially roles and bindings.
4. Review audit logs for batch creation calls from unexpected users.
5. Rotate artifact repository credentials held by Kargo if you find signs of misuse, since the advisory says exfiltrated credentials enable further attacks.

Why it matters

The record lists CWE-863, incorrect authorization. The batch endpoints accepted multi document YAML, and a flaw in their logic let specific resource types be created in a namespace using the server's own permissions, not the caller's. That turns a modest account into a way to raise your own permissions.

The advisory says this can lead to remote code execution or secret exfiltration. A promotion system holds credentials for registries and clusters, so a privilege escalation inside it is serious. The record does not mark this CVE as known exploited.

Quick check

Sources

• CVE-2026-27112 on Gold
• GitHub advisory listed in the record and fetched: https://github.com/akuity/kargo/security/advisories/GHSA-7g9x-cp9g-92mr
• Fix commit listed in the record: https://github.com/akuity/kargo/commit/155c6852ffbffa2902f18e6c7add91a846e8d344

Last reviewed: 19 October 2026.