CVE-2026-42350: Client-Side Open Redirect in Kargo UI OIDC Authentication Flow

Kargo is an open-source tool developed by Akuity that automates application promotion across environments. The vulnerability resides entirely within the frontend client-side user interface (UI) components responsible for managing user sessions and authentication via OpenID Connect (OIDC). Specifically, the vulnerability affects the login page, OIDC login redirection page, and token renewal components.

The attack surface is exposed via the redirectTo query parameter, which is designed to preserve the user's destination path prior to authenticating. Because the application processes this parameter without validation, attackers can manipulate the navigation target to point to external, malicious domains. This allows adversaries to construct deceptive links that leverage the trust of the legitimate Kargo deployment domain.

When an unauthenticated user accesses the manipulated link and successfully authenticates, the client-side router or browser navigation API automatically redirects the user's browser session. The primary risk of this behavior is phishing, where attackers redirect users to a cloned authentication interface to capture credentials or tokens. The vulnerability is tracked as CVE-2026-42350 with a Medium severity rating.

The root cause of CVE-2026-42350 is the absence of origin validation on the redirectTo query parameter before invoking client-side navigation. The Kargo UI uses React Router's navigate function and native browser APIs like window.location.replace() to execute redirections. These APIs accept destination paths as strings and resolve them relative to the current origin or as absolute URLs.

Under the WHATWG URL specification, certain path structures are normalized into absolute URLs, even if they initially appear to be relative paths. For instance, a protocol-relative path starting with two forward slashes (e.g., //attacker.com) is interpreted as an absolute URL targeting https://attacker.com. This behavior allows attackers to bypass naive checks that only verify the absence of an explicit protocol scheme like http:// or https://.

Furthermore, modern browsers normalize backslashes inside URL paths under specific conditions. A path starting with a forward slash followed by a backslash (e.g., /\attacker.com) normalizes to //attacker.com during parsing. Since the unpatched Kargo frontend simply extracted the redirectTo value and appended or passed it to navigation APIs, it failed to restrict the destination to the application's local origin.

To understand the exact code-level flaw, we examine the vulnerable implementation in Kargo UI and the corresponding patch. In the vulnerable version, the component extracts the redirectTo parameter from URLSearchParams and immediately performs navigation without any validation checks.

In oidc-login.tsx, the application uses window.location.replace(window.location.origin + redirectTo) to handle the redirect. While prepending the origin is intended to sanitize the redirect, some browsers resolve origin + //attacker.com as an external URL if the concatenation results in a malformed path structure that the browser recovers by navigating to the absolute portion. In token-renew.tsx and login.tsx, the raw parameter is passed directly to React Router's navigate or <Navigate /> component, allowing absolute path escapes.

The patch introduces a dedicated validation helper named isSafeRedirectPath in ui/src/config/auth.ts. This function first checks if the path string is null or does not start with a forward slash. It then uses the browser's native URL constructor to resolve the path against window.location.origin and strictly compares the resulting origin to ensure they match.

// File: ui/src/config/auth.ts
export const isSafeRedirectPath = (path: string | null): path is string => {
  if (!path || !path.startsWith('/')) return false;
  try {
    return new URL(path, window.location.origin).origin === window.location.origin;
  } catch {
    return false;
  }
};

By validating that the parameter starts with a single / and resolves to the exact same origin, the patch prevents both protocol-relative and backslash-prefixed bypasses. The calling components in oidc-login.tsx, token-renew.tsx, and login.tsx were updated to run this check and fall back to the default home path if the validation fails.

Exploitation of CVE-2026-42350 requires the attacker to construct a malicious URL and deliver it to a target user who has access to the Kargo deployment. The attacker begins by identifying the base URL of the target's Kargo instance, such as https://kargo.target-organization.com.

The attacker then appends the vulnerable login path and the redirectTo query parameter containing a protocol-relative URL pointing to an attacker-controlled domain. A typical exploit string is: https://kargo.target-organization.com/login?redirectTo=//phishing-kargo.com/login.

When the victim clicks the link, they see the legitimate domain in their address bar, which establishes trust. The victim performs the standard authentication flow via the configured OIDC identity provider. Once the identity provider issues the token and redirects the user back to Kargo, the Kargo frontend processes the successful login.

The frontend then executes the navigation logic using the unvalidated redirectTo parameter. The browser resolves the protocol-relative string //phishing-kargo.com/login to https://phishing-kargo.com/login and redirects the user. At this stage, the attacker presents a cloned login page or a message requesting additional credentials, effectively capturing sensitive user input.

The impact of CVE-2026-42350 is primarily associated with credential theft and session hijacking via phishing campaigns. While the vulnerability does not directly permit remote code execution on the Kargo server or database modification, it compromises the overall security posture of the continuous delivery (CD) pipeline.

Since Kargo manages application promotions across sensitive production environments, Kargo administrators possess high-privilege credentials. If an administrator is successfully phished through an open redirect, the attacker could obtain OIDC session tokens, API keys, or Okta credentials. This can lead to unauthorized access to the Kargo control plane, allowing attackers to promote malicious container images or modify application configurations.

The CVSS 4.0 score is calculated as 5.1 (Medium), reflecting the requirement for user interaction and the low subsequent impact on confidentiality. The EPSS score indicates a low short-term exploitation probability of 0.24%. However, because open redirect vulnerabilities require minimal technical skill to exploit, security teams should treat the risk as significant within enterprise environments.

The primary and recommended remediation for CVE-2026-42350 is upgrading the Kargo installation to a patched version. Maintainers have released fixes across multiple release lines to accommodate different deployment stages.

Organizations should identify their current Kargo version and upgrade according to the following schedule:

• Upgrade 1.7.x deployments to version 1.7.10 or later.
• Upgrade 1.8.x deployments to version 1.8.13 or later.
• Upgrade 1.9.x deployments to version 1.9.8 or later.
• Upgrade 1.10.x deployments to version 1.10.2 or later.

In environments where an immediate upgrade is not feasible, temporary mitigations can be applied at the ingress or reverse proxy layer. Web Application Firewalls (WAFs) or reverse proxies like Nginx can be configured with rules to block incoming requests containing external URLs or protocol-relative patterns in the redirectTo query parameter. Additionally, security awareness programs should instruct users to verify the address bar whenever they are redirected after logging into internal tools.