---
id: "CVE-2026-61850"
kind: "vulnerability"
aliases: ["CVE-2026-61850"]
title: "Kargo: project RBAC API lets delegated users escalate to project admin"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kargo", "kubernetes", "self-hosted"]
not_affected_if: ["default-roles-only", "versions-patched"]
published_at: "2026-10-30T20:17:11+00:00"
first_seen_at: "2026-10-30T20:25:38+00:00"
updated_at: "2026-10-30T20:26:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61850", "first_seen_at": "2026-10-30T20:25:38+00:00"}]
---

# Kargo: project RBAC API lets delegated users escalate to project admin

Kargo, a tool that automates promotion of software artifacts, has two authorization flaws in its project-scoped RBAC API. An authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts can grant themselves permissions they do not hold, reaching project-administrator access, Project Secrets and stored Git, container-registry or Helm-registry credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kargo version against the affected ranges (0.6.0 up to 1.8.14, 1.9.9 and 1.10.8).
- Review custom Kargo roles for grants of Roles or ServiceAccounts edit permissions.
- Check which accounts are assigned those custom roles.

## Fix

- Upgrade to `1.8.14`, `1.9.9` or `1.10.8`, matching your release line.

## Timeline

- 2026-10-30T20:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61850

## From the sources

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's `Roles` or `ServiceAccounts` confer permissions exceeding the user's own. A user authorized to edit `Roles` can create, replace, or add rules granting permissions not held by the user; a user authorized to edit a Role's ServiceAccount can bind an identity, including the user's own, to a more powerful Role. A Kargo Role comprises a `ServiceAccount, Role, and RoleBinding` in the Project namespace. Changes are written using the API server's broadly privileged credentials after only a coarse resource-kind edit check, rather than checking each permission being conferred. This permits escalation to Project-administrator access, disclosure of `Project Secrets` and credentials, and modification or deletion of Project resources. Stolen Git, container-registry, or Helm-registry credentials can extend confidentiality and integrity impacts to those external systems. Escalation remains limited to Projects where the attacker already has RBAC-management delegation and does not itself grant cluster-wide or cross-Project access. Default non-administrator roles do not permit these operations; exploitation requires an `administrator-created custom role` granting the relevant permissions and control of an account assigned that role. This issue is fixed in versions 1.8.14, 1.9.9, and 1.10.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_