OpenChoreo Kubernetes secrets leak

Published September 4, 2026 CVE-2026-73842

The flaw affects OpenChoreo older than 1.0.3 and has a security flaw.

Severity
CriticalCVSS 3.1 · 9.0
Fix
Fixed in 1.0.3, 1.1.3, 1.2.0Fix recorded on Sep 4, 2026
Affected versions
before 1.0.3; 1.1.0 or newer, but before 1.1.3; 1.2.0-rc.1 or newer, but before 1.2.0-rc.2
Weakness
CWE-269Improper Privilege Management
Exploit likelihood
0.18% in 30 daysEPSS, higher than 8% of known flaws
Affects
OpenChoreo

How it works

Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes.

What to do

Check whether the installed OpenChoreo version is older than 1.0.3.

Update OpenChoreo to 1.0.3 or newer. Then verify the installed version.

Technical details

The source identifies OpenChoreo as the affected product. Affected ranges: older than 1.0.3. Fixed versions: 1.0.3.

Severity breakdown

  • Attack vector Adjacent Needs access to the same local network
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source