CVE-2026-73843

CriticalCVSS 9.6

Published: 13/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Summary

OpenChoreo prior to 1.0.2 and 1.1.2 served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments.

Risk Assessment

An unauthenticated attacker can gain full control over Kubernetes clusters, leading to confidentiality, integrity, and availability breaches.

Recommendation

Upgrade OpenChoreo to version 1.0.2 or 1.1.2, which contain the fix.

Original NVD description (English source)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.