CVE-2026-27111: Akuity Kargo Auth Bypass Vulnerability

CVE-2026-27111 Overview

CVE-2026-27111 is an authorization bypass vulnerability affecting Akuity Kargo, a platform that manages and automates the promotion of software artifacts in Kubernetes environments. The vulnerability exists in versions v1.9.0 through v1.9.2 and allows users with standard Kubernetes RBAC permissions to bypass Kargo's custom promote verb authorization, potentially triggering unauthorized promotions through the REST API.

Critical Impact
Users without the explicit promote permission can bypass Kargo's fine-grained authorization model and trigger freight promotions, undermining the intended access control boundary for sensitive CI/CD pipeline operations.

Affected Products

Akuity Kargo v1.9.0
Akuity Kargo v1.9.1
Akuity Kargo v1.9.2

Discovery Timeline

2026-02-20 - CVE CVE-2026-27111 published to NVD
2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27111

Vulnerability Analysis

Kargo implements a custom authorization model that includes a promote verb—a non-standard Kubernetes "dolphin verb"—designed to gate the ability to advance Freight through a promotion pipeline. This verb was intentionally created to separate the ability to manage promotion-related resources from the ability to actually trigger promotions, enabling fine-grained access control over what is often a sensitive operation in GitOps workflows.

The vulnerability stems from an inconsistency between Kargo's legacy gRPC API and its newer REST API implementation. While the promote verb is correctly enforced in the gRPC API, three endpoints in the REST API fail to perform this authorization check. These endpoints only rely on standard Kubernetes RBAC for underlying resource operations (patch on freights/status or create on promotions), allowing users who hold those standard permissions—but who were deliberately not granted promote—to bypass the intended authorization boundary.

Root Cause

The root cause is a missing authorization check (CWE-862: Missing Authorization) in the REST API implementation. When the new REST API endpoints were developed, the developers failed to include the custom promote verb authorization that was already implemented in the legacy gRPC API. This oversight created an authorization inconsistency between the two API surfaces, allowing the security control to be bypassed through the REST API.

Attack Vector

An attacker with standard Kubernetes RBAC permissions (patch on freights/status or create on promotions) but without the explicit Kargo promote permission can exploit this vulnerability via network access to the REST API. The affected endpoints are:

/v1beta1/projects/{project}/freight/{freight}/approve
/v1beta1/projects/{project}/stages/{stage}/promotions
/v1beta1/projects/{project}/stages/{stage}/promotions/downstream

By sending requests to these endpoints, an attacker can approve freight or trigger promotions without proper authorization, potentially advancing unauthorized software artifacts through the promotion pipeline.

The security patch adds the missing authorization checks to the affected endpoints. The fix iterates through downstream stages and verifies promote authorization for each:

	for _, downstream := range downstreams {
		if err := s.authorizeFn(
			ctx,
			"promote",
			kargoapi.GroupVersion.WithResource("stages"),
			"",
			types.NamespacedName{
				Namespace: downstream.Namespace,
				Name:      downstream.Name,
			},
		); err != nil {
			_ = c.Error(err)
			return
		}
	}

Source: GitHub Commit

Detection Methods for CVE-2026-27111

Indicators of Compromise

Unexpected freight approvals or promotions in Kargo audit logs without corresponding promote permission grants
API access logs showing requests to /v1beta1/projects/{project}/freight/{freight}/approve or promotion endpoints from users lacking promote permissions
Anomalous promotion activity patterns in projects where fine-grained access controls were expected to prevent such operations

Detection Strategies

Review Kubernetes audit logs for API calls to the affected REST endpoints (/v1beta1/projects/{project}/freight/*/approve, /v1beta1/projects/{project}/stages/*/promotions)
Cross-reference promotion events with user permission mappings to identify unauthorized actions
Implement API gateway logging to capture all requests to Kargo REST API endpoints for forensic analysis

Monitoring Recommendations

Enable detailed audit logging for Kargo API endpoints to track all freight approval and promotion requests
Configure alerts for promotion activities from users or service accounts that do not have explicit promote permissions
Monitor for unusual patterns in promotion frequency or promotions occurring outside of normal deployment windows

How to Mitigate CVE-2026-27111

Immediate Actions Required

Upgrade Akuity Kargo to version v1.9.3 or later immediately
Review recent freight approvals and promotions for any unauthorized activity
Audit user permissions to ensure the principle of least privilege is enforced for promotion-related operations
Consider temporarily restricting REST API access until the patch is applied

Patch Information

Akuity has released version v1.9.3 which includes the security fix for this authorization bypass vulnerability. The patch adds proper promote verb authorization checks to all affected REST API endpoints, bringing them in line with the gRPC API implementation. The fix can be reviewed in commit 833314cad5513d48d89431493325ae44c1324a49. For detailed information, refer to the GitHub Security Advisory GHSA-5vvm-67pj-72g4.

Workarounds

Restrict network access to Kargo REST API endpoints using network policies or API gateway rules
Remove patch permissions on freights/status and create permissions on promotions from users who should not have promotion capabilities
Use the legacy gRPC API which correctly enforces the promote verb until the REST API can be patched
Implement additional API authentication layers to limit exposure of vulnerable endpoints

bash

# Verify current Kargo version
kubectl get deployment -n kargo kargo-controller -o jsonpath='{.spec.template.spec.containers[0].image}'

# Upgrade Kargo to patched version
helm upgrade kargo oci://ghcr.io/akuity/kargo-charts/kargo --version 1.9.3