CVE-2026-27112

CVE-2026-27112 is a critical vulnerability affecting Kargo versions from 1.7.0 up to, but not including, 1.7.8, 1.8.11, and 1.9.3. This flaw allows authenticated attackers to inject arbitrary resources into a project's namespace via specially crafted multi-document YAML payloads sent to Kargo's batch resource creation endpoints. With a CVSS score of 9.9 (CRITICAL), the vulnerability has a low attack complexity and can lead to privilege escalation, remote code execution, and secret exfiltration, leveraging the API server's permissions. There is currently no evidence of active exploitation, nor are public exploit codes like Metasploit or Nuclei available, though it has garnered some community discussion and media coverage.