Kargo: Privilege escalation via Project RBAC management in the Kargo API

Overview

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the project-scoped RBAC API let an authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts confer permissions exceeding the user's own. A user authorized to edit Roles can create, replace, or add rules granting permissions not held by the user; a user authorized to edit a Role's ServiceAccount can bind an identity, including the user's own, to a more powerful Role. A Kargo Role comprises a ServiceAccount, Role, and RoleBinding in the Project namespace. Changes are written using the API server's broadly privileged credentials after only a coarse resource-kind edit check, rather than checking each permission being conferred. This permits escalation to Project-administrator access, disclosure of Project Secrets and credentials, and modification or deletion of Project resources. Stolen Git, container-registry, or Helm-registry credentials can extend confidentiality and integrity impacts to those external systems. Escalation remains limited to Projects where the attacker already has RBAC-management delegation and does not itself grant cluster-wide or cross-Project access. Default non-administrator roles do not permit these operations; exploitation requires an administrator-created custom role granting the relevant permissions and control of an account assigned that role. This issue is fixed in versions 1.8.14, 1.9.9, and 1.10.8.

Affected

• kargo >= 0.6.0, < 1.8.14
• kargo >= 1.9.0-rc.1, < 1.9.9
• kargo >= 1.10.0-rc.1, < 1.10.8

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.