Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
CVE-2026-73842: OpenChoreo allows unauthenticated access to internal proxy
CVE-2026-73842 · published 2 months ago
Summary
Versions of OpenChoreo before the recent updates expose internal API endpoints without checking who is calling. This lets anyone on the network view sensitive configuration data and change or run commands in the Kubernetes environment. Upgrade to the latest released versions to secure those endpoints.
What to do
- Update github.com openchoreo to version 1.0.3.
- Update github.com openchoreo to version 1.1.3.
- Update github.com openchoreo to version 1.2.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | openchoreo | openchoreo | < 1.0.3 |
| go | github.com | openchoreo |
< 1.0.3 >= 1.1.0, < 1.1.3 >= 1.2.0-rc.1, < 1.2.0-rc.2 Fix: upgrade to 1.0.3
|
Original advisory text
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
References
- https://github.com/advisories/GHSA-rh53-xvx2-j327
- https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2 URL
- https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a7... Patch
- https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b... Patch
- https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95... Patch
- https://github.com/openchoreo/openchoreo/pull/4256 Patch
- https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73842 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73842... Vendor Advisory
- https://github.com/openchoreo/openchoreo/pull/4258 Patch
- https://github.com/openchoreo/openchoreo/pull/4259 Patch
- https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3 URL
- https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3 URL
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-269Improper Privilege Management
CWE-306Missing Authentication for Critical Function
CWE-862Missing Authorization
Timeline
Published13 Aug 2026
Updated7 Oct 2026
First seen13 Aug 2026
Track software like this
Free during beta