CVE-2026-73666

Received Received - Intake

Authentication Bypass in OpenChoreo Backstage

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73666

Affected Vendors & Products

Vendor	Product	Version / Range
openchoreo	backstage	1.0.4
openchoreo	backstage	1.1.4
openchoreo	backstage	1.2.1
openchoreo	backstage	to 1.0.4 (exc)
openchoreo	backstage	to 1.1.4 (exc)
openchoreo	backstage	to 1.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

OpenChoreo is a developer platform for Kubernetes. Prior to versions 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend had insecure default settings that disabled authentication for certain endpoints. This allowed unauthenticated access to /api/* endpoints, enabling unauthorized catalog reads, scaffolder log reads, and catalog location creation or deletion.

Impact Analysis

This vulnerability allows attackers to read sensitive data like catalogs and logs without authentication. They could also create or delete catalog locations, potentially disrupting services or causing data loss. The high CVSS score (8.2) indicates significant risk of unauthorized access and data exposure.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires strict access controls and data protection measures, while HIPAA mandates secure handling of sensitive health data. Unauthorized access risks breaches of these regulations.

Mitigation Strategies

Upgrade OpenChoreo Backstage to versions 1.0.4, 1.1.4, or 1.2.1 or later to address the hardcoded authentication bypass. Review and restrict access to /api/* endpoints to prevent unauthenticated catalog and scaffolder operations.

Hi! I’m here to help you understand CVE-2026-73666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70