CVE-2026-73842

CriticalCVSS 9.0

Published: 13/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Summary

OpenChoreo prior to 1.0.3, 1.1.3, and 1.2.0-rc.2 exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes.

Risk Assessment

An attacker can read secrets, modify workloads, and execute commands, leading to full environment compromise.

Recommendation

Upgrade OpenChoreo to version 1.0.3, 1.1.3, or 1.2.0-rc.2, which contain the fix.

Original NVD description (English source)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.