The vulnerability CVE-2026-42350 affects akuity kargo, a software artifact promotion and automation tool. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, the product is susceptible to an open redirect via the redirectTo query parameter in the UI OIDC login flow. This allows an attacker to craft URLs that redirect users to untrusted external sites, potentially facilitating phishing or other social engineering attacks. The issue has been addressed in the stated patched versions.

Successful exploitation could lead to users being redirected to malicious or untrusted websites, which may facilitate phishing attacks or other social engineering tactics. There is no indication of direct code execution or data compromise from this vulnerability alone. The medium CVSS score reflects the moderate risk posed by this issue.

Upgrade akuity kargo to versions 1.7.10, 1.8.13, 1.9.8, or 1.10.2 or later, where this open redirect vulnerability has been patched. Since the vendor advisory indicates the issue is fixed in these versions, applying the official updates is the recommended remediation. No additional mitigation steps are specified.