{"schema_version":"1.7.3","id":"GO-2026-4385","published":"2026-02-02T21:05:59Z","modified":"2026-03-03T04:57:54.887935Z","aliases":["CVE-2026-24748","GHSA-w5wv-wvrp-v5m5"],"summary":"Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access in github.com/akuity/kargo","details":"Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access in github.com/akuity/kargo","affected":[{"package":{"name":"github.com/akuity/kargo","ecosystem":"Go","purl":"pkg:golang/github.com/akuity/kargo"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.3"},{"introduced":"1.7.0-rc.1"},{"fixed":"1.7.7"},{"introduced":"1.8.0-rc.1"},{"fixed":"1.8.7"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4385.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24748"},{"type":"FIX","url":"https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772"},{"type":"FIX","url":"https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7"},{"type":"FIX","url":"https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c"}],"database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-4385"}}