Paper/Archive/CVE-2026-73842

CVE-2026-73842

openchoreo openchoreo — OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

EPSS 0.3%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 19.1.191 × 203.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

Affected

ProductAffectedFixed inSource

openchoreo< 1.0.3–CNA

openchoreo>= 1.1.0, < 1.1.3–CNA

openchoreo>= 1.2.0-rc.1, < 1.2.0-rc.2–CNA

Scores by source

GitHub_M (CNA)9.0CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References