Listen to this Post
The Kargo UI reads a `redirectTo` query parameter on the `/login` and `/token-renew` routes. Following a successful OIDC authentication, the application uses the value of this parameter as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI’s own origin. Protocol-relative values (e.g. //attacker.example.com) and values using a backslash prefix (e.g. /\attacker.example.com) are accepted and result in navigation to an external origin.
An attacker can exploit this by crafting a URL of the form `https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\attacker.example.com` and delivering it to a victim through any channel that permits link sharing. When the victim follows the link and signs in to Kargo, the browser is redirected to the attacker-controlled origin. Because the initial URL resolves to the legitimate Kargo host and the user is genuinely authenticated in the process, the redirect inherits the perceived trust of the user’s own Kargo instance. The principal risk is that such a redirect can serve as a stepping stone for credentials phishing. The attacker-controlled page can present a UI resembling Kargo or an associated identity provider and solicit credentials from the user. The vulnerability does not, by itself, expose any data from Kargo or permit modification of Kargo resources, and it does not affect authentication when Kargo’s built-in admin credentials are used.
Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to this open redirect. The issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.
DailyCVE Form:
Platform: Kargo UI
Version: <1.7.10, <1.8.13, <1.9.8, <1.10.2
Vulnerability: Open Redirect (CWE-601)
Severity: Low
Date: 2026-05-08
Prediction: Already Patched (2026-05)
What Undercode Say:
Check Kargo version
kubectl get deployment kargo-api -n kargo -o jsonpath='{.spec.template.spec.containers[bash].image}'
Verify fix in version 1.7.10, 1.8.13, 1.9.8, or 1.10.2 kubectl describe deployment kargo-api -n kargo | grep Image
Exploit: (Educational Purposes!)
Craft malicious redirect URL
ATTACKER_DOMAIN="attacker.example.com"
KARGO_DOMAIN="kargo.example.com"
MALICIOUS_URL="${KARGO_DOMAIN}/login?redirectTo=/token-renew?redirectTo=/\${ATTACKER_DOMAIN}"
echo $MALICIOUS_URL
GET /login?redirectTo=/token-renew?redirectTo=//attacker.example.com HTTP/1.1 Host: kargo.example.com
// Client-side navigation occurs after OIDC auth window.location.href = redirectTo; // Unsanitized
Protection:
- Upgrade to Kargo version 1.7.10, 1.8.13, 1.9.8, or 1.10.2 or later
- Validate and sanitize all `redirectTo` parameters against an allowlist of permitted origins
- Implement proper URL validation to reject protocol-relative and backslash-prefixed values
- Use `URL` constructor and validate hostname against an allowlist
- Consider using `SameSite` cookies and referrer policies to mitigate phishing risks
Impact:
- Allows open redirect to attacker-controlled external origins
- Enables credential phishing via trusted Kargo URL
- CVSS v4 score: 0.0 (None)
- Does not expose Kargo data or permit resource modification
- Does not affect authentication when built-in admin credentials are used
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
