CVE-2026-73667
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.0-rc.2 has a vulnerability in Workflow Plane templates where developer-controlled parameters are interpolated into shell code executed via sh -c instead of being passed through container.env. This allows arbitrary commands to run in workflow pods, and affected privileged Podman templates lacked hostUsers: false.
Risk Assessment
Risk of unauthorized command execution in workflow pods, potentially leading to privilege escalation or environment compromise.
Recommendation
Update OpenChoreo to versions 1.0.4, 1.1.4, or 1.2.0-rc.2, which include the fix.
Original NVD description (English source)
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.