Search
Find a vulnerability
Search criteria
12 vulnerabilities found for openchoreo by openchoreo
CVE-2026-73843 (GCVE-0-2026-73843)
Vulnerability from nvd – Published: 2026-08-13 22:02 – Updated: 2026-08-14 18:06
VLAI
EPSS
VEX
Title
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 17:53 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4122 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/0… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/0… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/b… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.2
Affected: >= 1.1.0, < 1.1.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73843",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T17:53:55.078114Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T18:06:50.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T22:02:41.363Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4122",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4122"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2"
}
],
"source": {
"advisory": "GHSA-qh9r-j7rp-4x2m",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73843",
"datePublished": "2026-08-13T22:02:41.363Z",
"dateReserved": "2026-08-13T17:44:28.643Z",
"dateUpdated": "2026-08-14T18:06:50.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73842 (GCVE-0-2026-73842)
Vulnerability from nvd – Published: 2026-08-13 21:59 – Updated: 2026-08-18 01:44
VLAI
EPSS
VEX
Title
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 01:44 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4256 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4258 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4259 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/5… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/9… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/e… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.3
Affected: >= 1.1.0, < 1.1.3 Affected: >= 1.2.0-rc.1, < 1.2.0-rc.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T01:44:15.428285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T01:44:27.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.3"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.3"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0-rc.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:59:24.390Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4256",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4256"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4258",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4258"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4259",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4259"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"source": {
"advisory": "GHSA-rh53-xvx2-j327",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only \u2014 data-plane Secret disclosure and arbitrary Kubernetes mutation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73842",
"datePublished": "2026-08-13T21:59:24.390Z",
"dateReserved": "2026-08-13T17:44:28.642Z",
"dateUpdated": "2026-08-18T01:44:27.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73841 (GCVE-0-2026-73841)
Vulnerability from nvd – Published: 2026-08-13 21:56 – Updated: 2026-08-14 16:10
VLAI
EPSS
VEX
Title
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:10 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
>= 1.2.0-rc.1, < 1.2.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73841",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:10:15.605946Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:10:29.515Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:56:13.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx"
}
],
"source": {
"advisory": "GHSA-52gf-6rpq-fgmx",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73841",
"datePublished": "2026-08-13T21:56:13.057Z",
"dateReserved": "2026-08-13T17:44:28.642Z",
"dateUpdated": "2026-08-14T16:10:29.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73840 (GCVE-0-2026-73840)
Vulnerability from nvd – Published: 2026-08-13 21:52 – Updated: 2026-08-14 16:26
VLAI
EPSS
VEX
Title
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:25 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4239 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4252 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4253 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/2… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/8… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/f… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.3
Affected: >= 1.1.0, < 1.1.3 Affected: >= 1.2.0-rc.1, < 1.2.0-rc.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:25:46.438980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:26:09.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.3"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.3"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0-rc.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:52:27.995Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4239",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4239"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4252",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4252"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4253",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4253"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"source": {
"advisory": "GHSA-c5f6-2rm9-2w8g",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73840",
"datePublished": "2026-08-13T21:52:27.798Z",
"dateReserved": "2026-08-13T17:44:28.640Z",
"dateUpdated": "2026-08-14T16:26:09.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73667 (GCVE-0-2026-73667)
Vulnerability from nvd – Published: 2026-08-13 21:43 – Updated: 2026-08-17 17:18
VLAI
EPSS
VEX
Title
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 17:14 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4193 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4243 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4277 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4297 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/0… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/6… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/b… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/f… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.4
Affected: >= 1.1.0, < 1.1.4 Affected: >= 1.2.0-rc.1, < 1.2.0-rc.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T17:14:17.168440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T17:18:14.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.4"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.4"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0-rc.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:44:02.906Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-2mw5-23gm-pccq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-2mw5-23gm-pccq"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4193",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4193"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4243",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4243"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4277",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4277"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4297",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4297"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/65c081ff74618714cb0c82b5d0e0fad2c2cbc46b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/65c081ff74618714cb0c82b5d0e0fad2c2cbc46b"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/b274127a4342e5433c5035384cef57478b5b65ed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/b274127a4342e5433c5035384cef57478b5b65ed"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/fb2b659b9884eb45fa4f02b9cc7e89718a0276b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/fb2b659b9884eb45fa4f02b9cc7e89718a0276b7"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.4"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.4"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"source": {
"advisory": "GHSA-2mw5-23gm-pccq",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73667",
"datePublished": "2026-08-13T21:43:43.895Z",
"dateReserved": "2026-08-13T14:04:09.606Z",
"dateUpdated": "2026-08-17T17:18:14.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73666 (GCVE-0-2026-73666)
Vulnerability from nvd – Published: 2026-08-13 21:40 – Updated: 2026-08-14 18:06
VLAI
EPSS
VEX
Title
OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete
Summary
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 17:41 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/backstage-plugins/p… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/p… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/p… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/p… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/c… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/c… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/c… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/c… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/r… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/r… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/r… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | backstage-plugins |
Affected:
< 1.0.4
Affected: >= 1.1.0, < 1.1.4 Affected: >= 1.2.0-rc.1, < 1.2.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73666",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T17:41:32.214383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T18:06:57.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "backstage-plugins",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.4"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.4"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T22:03:27.006Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/pull/709",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/pull/709"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/pull/712",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/pull/712"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/pull/713",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/pull/713"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/pull/716",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/pull/716"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1"
}
],
"source": {
"advisory": "GHSA-v7qx-mqhq-grvh",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73666",
"datePublished": "2026-08-13T21:40:13.597Z",
"dateReserved": "2026-08-13T14:04:09.606Z",
"dateUpdated": "2026-08-14T18:06:57.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73843 (GCVE-0-2026-73843)
Vulnerability from cvelistv5 – Published: 2026-08-13 22:02 – Updated: 2026-08-14 18:06
VLAI
EPSS
VEX
Title
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 17:53 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4122 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/0… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/0… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/b… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.2
Affected: >= 1.1.0, < 1.1.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73843",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T17:53:55.078114Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T18:06:50.045Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T22:02:41.363Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4122",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4122"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2"
}
],
"source": {
"advisory": "GHSA-qh9r-j7rp-4x2m",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73843",
"datePublished": "2026-08-13T22:02:41.363Z",
"dateReserved": "2026-08-13T17:44:28.643Z",
"dateUpdated": "2026-08-14T18:06:50.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73842 (GCVE-0-2026-73842)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:59 – Updated: 2026-08-18 01:44
VLAI
EPSS
VEX
Title
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 01:44 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4256 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4258 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4259 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/5… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/9… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/e… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.3
Affected: >= 1.1.0, < 1.1.3 Affected: >= 1.2.0-rc.1, < 1.2.0-rc.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T01:44:15.428285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T01:44:27.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.3"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.3"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0-rc.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:59:24.390Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4256",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4256"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4258",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4258"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4259",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4259"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"source": {
"advisory": "GHSA-rh53-xvx2-j327",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only \u2014 data-plane Secret disclosure and arbitrary Kubernetes mutation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73842",
"datePublished": "2026-08-13T21:59:24.390Z",
"dateReserved": "2026-08-13T17:44:28.642Z",
"dateUpdated": "2026-08-18T01:44:27.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73841 (GCVE-0-2026-73841)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:56 – Updated: 2026-08-14 16:10
VLAI
EPSS
VEX
Title
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:10 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
>= 1.2.0-rc.1, < 1.2.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73841",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:10:15.605946Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:10:29.515Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:56:13.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx"
}
],
"source": {
"advisory": "GHSA-52gf-6rpq-fgmx",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73841",
"datePublished": "2026-08-13T21:56:13.057Z",
"dateReserved": "2026-08-13T17:44:28.642Z",
"dateUpdated": "2026-08-14T16:10:29.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73840 (GCVE-0-2026-73840)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:52 – Updated: 2026-08-14 16:26
VLAI
EPSS
VEX
Title
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:25 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4239 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4252 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4253 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/2… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/8… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/f… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.3
Affected: >= 1.1.0, < 1.1.3 Affected: >= 1.2.0-rc.1, < 1.2.0-rc.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:25:46.438980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:26:09.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.3"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.3"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0-rc.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:52:27.995Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4239",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4239"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4252",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4252"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4253",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4253"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"source": {
"advisory": "GHSA-c5f6-2rm9-2w8g",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73840",
"datePublished": "2026-08-13T21:52:27.798Z",
"dateReserved": "2026-08-13T17:44:28.640Z",
"dateUpdated": "2026-08-14T16:26:09.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73667 (GCVE-0-2026-73667)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:43 – Updated: 2026-08-17 17:18
VLAI
EPSS
VEX
Title
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 17:14 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4193 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4243 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4277 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4297 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/0… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/6… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/b… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/f… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.4
Affected: >= 1.1.0, < 1.1.4 Affected: >= 1.2.0-rc.1, < 1.2.0-rc.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T17:14:17.168440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T17:18:14.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.4"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.4"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0-rc.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:44:02.906Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-2mw5-23gm-pccq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-2mw5-23gm-pccq"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4193",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4193"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4243",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4243"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4277",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4277"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4297",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4297"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/65c081ff74618714cb0c82b5d0e0fad2c2cbc46b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/65c081ff74618714cb0c82b5d0e0fad2c2cbc46b"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/b274127a4342e5433c5035384cef57478b5b65ed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/b274127a4342e5433c5035384cef57478b5b65ed"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/fb2b659b9884eb45fa4f02b9cc7e89718a0276b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/fb2b659b9884eb45fa4f02b9cc7e89718a0276b7"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.4"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.4"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"source": {
"advisory": "GHSA-2mw5-23gm-pccq",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73667",
"datePublished": "2026-08-13T21:43:43.895Z",
"dateReserved": "2026-08-13T14:04:09.606Z",
"dateUpdated": "2026-08-17T17:18:14.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73666 (GCVE-0-2026-73666)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:40 – Updated: 2026-08-14 18:06
VLAI
EPSS
VEX
Title
OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete
Summary
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 17:41 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/backstage-plugins/p… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/p… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/p… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/p… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/c… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/c… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/c… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/c… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/r… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/r… | x_refsource_MISC |
| https://github.com/openchoreo/backstage-plugins/r… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | backstage-plugins |
Affected:
< 1.0.4
Affected: >= 1.1.0, < 1.1.4 Affected: >= 1.2.0-rc.1, < 1.2.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73666",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T17:41:32.214383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T18:06:57.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "backstage-plugins",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.4"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.4"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T22:03:27.006Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/pull/709",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/pull/709"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/pull/712",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/pull/712"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/pull/713",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/pull/713"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/pull/716",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/pull/716"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4"
},
{
"name": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1"
}
],
"source": {
"advisory": "GHSA-v7qx-mqhq-grvh",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73666",
"datePublished": "2026-08-13T21:40:13.597Z",
"dateReserved": "2026-08-13T14:04:09.606Z",
"dateUpdated": "2026-08-14T18:06:57.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}