CVE-2026-73843

CRITICAL 9.6

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.

CWE	CWE-306 CWE-668 CWE-862
Vendor	openchoreo
Product	openchoreo
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for openchoreo openchoreo

Be the first to know when new critical vulnerabilities affecting openchoreo openchoreo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

openchoreo / openchoreo

< 1.0.2 >= 1.1.0, < 1.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m github.com: https://github.com/openchoreo/openchoreo/pull/4122 github.com: https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce github.com: https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a github.com: https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f github.com: https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2 github.com: https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2