CVE-2026-73841

HighCVSS 8.8

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

OpenChoreo up to version 1.2.0 has a vulnerability where authorization for commands and wirelogs uses the caller-supplied project parameter instead of the actual component owner. A user with project-scoped grants can execute commands and read wirelogs in components of other projects in the same namespace.

Risk Assessment

Risk of unauthorized access to components and data of other projects in the Kubernetes cluster, potentially leading to confidentiality and integrity breaches.

Recommendation

Update OpenChoreo to version 1.2.0 or later, which includes the fix.

Original NVD description (English source)

OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0.