CVE-2026-73843

OpenChoreo prior to 1.0.3, 1.1.3, and 1.2.0-rc.2 exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes.

OpenChoreo before versions 1.1.6 and 1.2.3 authorizes component:exec and wirelogs:view using the caller-supplied project query parameter instead of the component's owner project name. This allows a user with project-scoped grants to execute commands and read wirelogs from components owned by other projects in the same namespace.

OpenChoreo prior to versions 1.0.3, 1.1.3, and 1.2.0-rc.2 has a vulnerability in the POST /api/v1alpha1/autobuild endpoint. Webhook provider selection relies on attacker-controlled X-Event-Key, and Bitbucket requests are accepted without HMAC-SHA256 verification. This allows unauthenticated build triggers for components matched by repository URL and branch, including cross-provider attacks using attacker-supplied commit SHAs.

OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.0-rc.2 has a vulnerability in Workflow Plane templates where developer-controlled parameters are interpolated into shell code executed via sh -c instead of being passed through container.env. This allows arbitrary commands to run in workflow pods, and affected privileged Podman templates lacked hostUsers: false.

OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.1 has a vulnerability in the Backstage backend where default authentication policy is hardcoded to be disabled and guest access is allowed outside development. This results in unauthenticated access to /api/*, allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion.