Authorization bypass in openchoreo
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| openchoreo | openchoreo | 1.2.0-m.1 to before 1.2.3; before 1.1.6 | 1.2.3, 1.1.6 | Patch available | CNA |
| — | github.com/openchoreo/openchoreo (Go) | 1.2.0-m.1 to before 1.2.3 | 1.2.3 | Patch available | GHSA-52gf-6rpq-fgmx |
| — | github.com/openchoreo/openchoreo (Go) | before 1.1.6 | 1.1.6 | Patch available | GHSA-52gf-6rpq-fgmx |
- openchoreo Vendoropenchoreo Affected 1.2.0-m.1 to before 1.2.3; before 1.1.6 Fixed in 1.2.3, 1.1.6 Patch available CNA
- github.com/openchoreo/openchoreo (Go) Vendor— Affected 1.2.0-m.1 to before 1.2.3 Fixed in 1.2.3 Patch available GHSA-52gf-6rpq-fgmx
- github.com/openchoreo/openchoreo (Go) Vendor— Affected before 1.1.6 Fixed in 1.1.6 Patch available GHSA-52gf-6rpq-fgmx
Remediation
- Fix · CNA openchoreo (openchoreo) Fixed in 1.2.3, 1.1.6
- Fix · GHSA-52gf-6rpq-fgmx github.com/openchoreo/openchoreo (Go) Fixed in 1.2.3 Advisory →
- Fix · GHSA-52gf-6rpq-fgmx github.com/openchoreo/openchoreo (Go) Fixed in 1.1.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73841
- 2026-10-03 Alias added: GHSA-52gf-6rpq-fgmx
References
Other 10
- https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx
- https://github.com/openchoreo/openchoreo/pull/4251
- https://github.com/openchoreo/openchoreo/pull/4516
- https://github.com/openchoreo/openchoreo/pull/4538
- https://github.com/openchoreo/openchoreo/commit/4d372eaf1f07525663dcca5257062f4b051b9820
- https://github.com/openchoreo/openchoreo/commit/9d77b64f747eba89247c47ebfeffec591c4cd2d8
- https://github.com/openchoreo/openchoreo/commit/c9390e4fcb9953f43b07cb48197576182301593d
- https://github.com/openchoreo/openchoreo/releases/tag/v1.1.6
- https://github.com/openchoreo/openchoreo/releases/tag/v1.2.3
- https://github.com/openchoreo/openchoreo
More openchoreo vulnerabilities
- TI-2026-51866 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs CVSS 3.1CRITICAL 9.6
- TI-2026-51750 Missing authentication in openchoreo backstage-plugins CVSS 3.1HIGH 8.2
- TI-2026-51751 OS command injection in openchoreo CVSS 3.1HIGH 8.8
- TI-2026-51865 Improper privilege management in openchoreo CVSS 3.1CRITICAL 9.0
- TI-2026-78530 OpenChoreo authorization bypass lets callers take over workflow runs CVSS 3.1HIGH 7.4
- TI-2026-51863 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-73841 · CVE Program
- CVE-2026-73841 · NVD
- FIRST EPSS
- GHSA-52gf-6rpq-fgmx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences