TI-2026-51865 Aliases CVE-2026-73842 GHSA-rh53-xvx2-j327

Improper privilege management in openchoreo

MEDIUM 40CWE-269Published 2026-08-13 · Updated 2026-08-18

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-306.

Summary

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00269 19th percentileScored 2026-11-07

Fix Fixed openchoreo (openchoreo): 1.0.3, 1.1.3, 1.2.0-rc.2github.com/openchoreo/openchoreo (Go): 1.0.3, 1.1.3, 1.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openchoreo	openchoreo	before 1.0.3; 1.1.0 to before 1.1.3; 1.2.0-rc.1 to before 1.2.0-rc.2	1.0.3, 1.1.3, 1.2.0-rc.2	Patch available	CNA
—	github.com/openchoreo/openchoreo (Go)	before 1.0.3	1.0.3	Patch available	GHSA-rh53-xvx2-j327
—	github.com/openchoreo/openchoreo (Go)	1.1.0 to before 1.1.3	1.1.3	Patch available	GHSA-rh53-xvx2-j327
—	github.com/openchoreo/openchoreo (Go)	1.2.0-rc.1 to before 1.2.0	1.2.0	Patch available	GHSA-rh53-xvx2-j327

openchoreo Vendoropenchoreo Affected before 1.0.3; 1.1.0 to before 1.1.3; 1.2.0-rc.1 to before 1.2.0-rc.2 Fixed in 1.0.3, 1.1.3, 1.2.0-rc.2 Patch available CNA
github.com/openchoreo/openchoreo (Go) Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available GHSA-rh53-xvx2-j327
github.com/openchoreo/openchoreo (Go) Vendor— Affected 1.1.0 to before 1.1.3 Fixed in 1.1.3 Patch available GHSA-rh53-xvx2-j327
github.com/openchoreo/openchoreo (Go) Vendor— Affected 1.2.0-rc.1 to before 1.2.0 Fixed in 1.2.0 Patch available GHSA-rh53-xvx2-j327

Remediation

Fix · CNA openchoreo (openchoreo) Fixed in 1.0.3, 1.1.3, 1.2.0-rc.2
Fix · GHSA-rh53-xvx2-j327 github.com/openchoreo/openchoreo (Go) Fixed in 1.0.3 Advisory →
Fix · GHSA-rh53-xvx2-j327 github.com/openchoreo/openchoreo (Go) Fixed in 1.1.3 Advisory →
Fix · GHSA-rh53-xvx2-j327 github.com/openchoreo/openchoreo (Go) Fixed in 1.2.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-73842
2026-10-03 Alias added: GHSA-rh53-xvx2-j327

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-73842

Other 11

TI-2026-51866 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs CVSS 3.1CRITICAL 9.6
TI-2026-51750 Missing authentication in openchoreo backstage-plugins CVSS 3.1HIGH 8.2
TI-2026-51864 Authorization bypass in openchoreo CVSS 3.1HIGH 8.8
TI-2026-51751 OS command injection in openchoreo CVSS 3.1HIGH 8.8
TI-2026-78530 OpenChoreo authorization bypass lets callers take over workflow runs CVSS 3.1HIGH 7.4
TI-2026-51863 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences