CVE-2026-73666
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.1 has a vulnerability in the Backstage backend where default authentication policy is hardcoded to be disabled and guest access is allowed outside development. This results in unauthenticated access to /api/*, allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion.
Risk Assessment
Risk of unauthorized access to Backstage data and functions, potentially leading to information disclosure or configuration manipulation.
Recommendation
Update OpenChoreo to versions 1.0.4, 1.1.4, or 1.2.1, which include the fix.
Original NVD description (English source)
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.