CVE-2026-73842

Received Received - Intake

Authentication Bypass in OpenChoreo Kubernetes Platform

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73842

Affected Vendors & Products

Vendor	Product	Version / Range
openchoreo	openchoreo	to 1.0.3 (inc)
openchoreo	openchoreo	to 1.1.3 (inc)
openchoreo	openchoreo	to 1.2.0-rc.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

OpenChoreo is a developer platform for Kubernetes. A vulnerability in versions before 1.0.3, 1.1.3, and 1.2.0-rc.2 exposed internal API endpoints (/api/proxy/, /api/exec/, /api/wirelogs/) on an internal listener without authentication. This allowed unauthorized network access to read Kubernetes Secrets, modify workloads, and execute commands across connected systems.

Detection Guidance

Check for exposed internal listeners on OpenChoreo instances by inspecting network traffic to /api/proxy/, /api/exec/, and /api/wirelogs/ endpoints. Verify if these endpoints are accessible without authentication. Use tools like curl to test connectivity to these paths on internal ports.

Impact Analysis

Attackers could access sensitive Kubernetes Secrets, alter workloads, or run arbitrary commands on connected systems. This could lead to data breaches, service disruption, or unauthorized control of infrastructure. The impact depends on the exposed data and workloads.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR, HIPAA) due to unauthorized access to sensitive data (Secrets) and potential data exposure. It undermines confidentiality and integrity controls required by these standards.

Mitigation Strategies

Upgrade OpenChoreo to versions 1.0.3, 1.1.3, or 1.2.0-rc.2 or later to fix the issue. Block access to /api/proxy/, /api/exec/, and /api/wirelogs/ endpoints on internal listeners until patched.

Hi! I’m here to help you understand CVE-2026-73842. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70