CVE-2026-73667

Received Received - Intake

Command Injection in OpenChoreo Workflow Plane

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73667

Affected Vendors & Products

Vendor	Product	Version / Range
openchoreo	workflow_plane	to 1.0.4 (inc)
openchoreo	workflow_plane	to 1.1.4 (inc)
openchoreo	workflow_plane	to 1.2.0-rc.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

OpenChoreo is a developer platform for Kubernetes. Prior to versions 1.0.4, 1.1.4, and 1.2.0-rc.2, it had a flaw where workflow templates interpolated user-controlled parameters directly into shell commands executed via sh -c. This allowed attackers to inject arbitrary commands into workflow pods. Some privileged Podman templates also lacked proper user isolation settings.

Impact Analysis

If you use OpenChoreo with affected versions, an attacker with workflow access could execute arbitrary commands on your Kubernetes cluster. This could lead to data theft, system compromise, or disruption of services. Privileged Podman templates could allow deeper system access due to missing user restrictions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations using OpenChoreo may face compliance violations if exploited, potentially resulting in fines or legal consequences.

Mitigation Strategies

Update OpenChoreo to versions 1.0.4, 1.1.4, or 1.2.0-rc.2 or later to address the vulnerability. Review workflow templates for arbitrary command injection risks and ensure privileged Podman templates include hostUsers: false.

Hi! I’m here to help you understand CVE-2026-73667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70