OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0018.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
openchoreo openchoreo affected
Version Status Constraints
< 1.0.3 affected —
>= 1.1.0, < 1.1.3 affected —
>= 1.2.0-rc.1, < 1.2.0-rc.2 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Openchoreo Subscribe
Openchoreo Subscribe

Project Subscriptions

Vendors Products
Openchoreo Subscribe
Openchoreo Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04 cve-icon cve-icon
https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129 cve-icon cve-icon
https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a cve-icon cve-icon
https://github.com/openchoreo/openchoreo/pull/4256 cve-icon cve-icon
https://github.com/openchoreo/openchoreo/pull/4258 cve-icon cve-icon
https://github.com/openchoreo/openchoreo/pull/4259 cve-icon cve-icon
https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3 cve-icon cve-icon
https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3 cve-icon cve-icon
https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2 cve-icon cve-icon
https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327 cve-icon cve-icon
History

Fri, 14 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Openchoreo
Openchoreo openchoreo
Vendors & Products Openchoreo
Openchoreo openchoreo

Thu, 13 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Title OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
Weaknesses CWE-269
CWE-306
CWE-862
References
Metrics cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-13T21:59:24.390Z

Reserved: 2026-08-13T17:44:28.642Z

Link: CVE-2026-73842

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T22:17:29.037

Modified: 2026-08-13T22:17:29.037

Link: CVE-2026-73842

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T12:14:20Z

Weaknesses