Log in Start free

Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M

CVE-2026-73842OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

Critical 9.0

In plain English

A critical-severity privilege mismanagement in openchoreo from openchoreo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/openchoreo/openchoreo1.0.3GHSA-rh53-xvx2-j327
Gogithub.com/openchoreo/openchoreo1.1.3GHSA-rh53-xvx2-j327
Gogithub.com/openchoreo/openchoreo1.2.0GHSA-rh53-xvx2-j327
Gogithub.com/openchoreo/openchoreo1.0.3, 1.1.3, 1.2.0GO-2026-6428

Affected products (as reported)

VendorProductVersions
openchoreo openchoreo < 1.0.3>= 1.1.0, < 1.1.3>= 1.2.0-rc.1, < 1.2.0-rc.2

Weakness: CWE-269, CWE-306, CWE-862 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References