Kargo: project RBAC delegation lets a user grant itself permissions it does not hold

Impact

Kargo is a GitOps promotion controller that holds the credentials used to move artifacts between environments. A user who has been delegated management of a Project's Roles or ServiceAccounts can write rules granting permissions beyond their own, or bind their own identity to a more powerful Role, because the API server applies the change with its own broadly privileged credentials after only a coarse resource-kind edit check. The result is Project-administrator access: read of Project Secrets, which on a GPU fleet typically means the Git, container-registry and Helm-registry credentials used to publish the images that land on GPU nodes, plus modification or deletion of Project resources. Escalation stays inside Projects where the attacker already holds RBAC-management delegation and does not reach cluster-wide or cross-Project scope. Default non-administrator roles cannot do this; exploitation needs an administrator-created custom role granting those permissions and control of an account holding it.

Who can reach it

An authenticated Kargo user who already holds delegated permission to edit Roles or ServiceAccounts in at least one Project. No unauthenticated path.

What to do

Upgrade Kargo to 1.8.14, 1.9.9 or 1.10.8 and restart the Kargo API server and controllers; no node-level work is needed. Until then, review which custom roles grant Role or ServiceAccount edit permissions inside Projects and who holds them, and rotate any Git, container-registry or Helm credentials stored as Project Secrets in Projects where such delegation was handed out.

References

Related entries

• Multicluster Engine cluster-proxy-addon: unauthenticated path manipulation proxies to any managed-cluster serviceCVE-2026-66794 · Red Hat Multicluster Engine for Kubernetes (cluster-proxy-addon)Critical
• Traefik: crafted Host port bypasses BasicAuth and IP allowlists on ingress-nginx annotated IngressesCVE-2026-88877 · Traefik ingress-nginx provider (from-to-www-redirect sibling router)Critical
• Kata Containers: runtime-rs standalone virtio-fs path is vulnerable to a guest-to-host escapeCVE-2026-47243 · Kata ContainersCritical
• Cilium: With L7 enabled, the embedded Envoy exposes a world-accessible admin.sock on the clusterCVE-2026-49445 · CiliumCritical
• Rancher: Anyone who can create role template bindings escalates privileges cluster-wideCVE-2022-31247 · RancherCritical
• Argo CD: Improper authorization lets a user modify resources outside their permitted projectsCVE-2023-23947 · Argo CDCritical