CVE-2026-73843

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

CVSS 3.1 9.6 CRITICALEUVD CVSS 3.1 9.6 CVSS 3.1 · [email protected] · Secondary 9.6 CRITICALCVSS_V3 Publisher rating CRITICALFixed by github.com/openchoreo/openchoreo 1.0.2 Fixed by github.com/openchoreo/openchoreo 1.1.2osv · severity unknownFixed by github.com/openchoreo/openchoreo 1.0.2 Fixed by github.com/openchoreo/openchoreo 1.1.2KEV status unknown

Original advisory

cve-program · CVE-2026-73843

Published

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.

Read the publisher's advisory

euvd · EUVD-2026-58518

Published

Read the publisher's advisory

nvd · CVE-2026-73843

Published

Read the publisher's advisory

osv · GHSA-qh9r-j7rp-4x2m

Published

### Summary The OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the calling client. A party able to reach the listener could therefore invoke privileged data-plane operations without authenticating and without passing through the OpenChoreo API server's authorization. ### Impact An attacker who can reach the externally published cluster-gateway endpoint can perform data-plane operations normally restricted to the OpenChoreo API server and gated by its authorization — including proxying the data plane's Kubernetes API and executing commands inside workload pods. This can result in full compromise of workloads on the affected data plane (disclosure, tampering, and denial of service). The exposure applies to the multi-cluster / remote data-plane topology, where the cluster-gateway is published outside the cluster so remote data-plane agents can connect. That same externally reachable listener also served the caller-facing management APIs, which did not authenticate the caller. Deployments that do not publish the cluster-gateway outside the cluster are not affected. ### Patches Fixed in **1.0.2**, **1.1.2**, and **1.2.0**. The fix moves the caller-facing management APIs onto a separate internal listener that is not published outside the cluster, leaving only the agent-connection endpoint on the externally reachable listener. Upgrading is non-disruptive — no data-plane agent or configuration changes are required beyond the standard chart upgrade. Upgrade path: 1.1.x → 1.1.2, 1.0.x and earlier → 1.0.2, 1.2 line → 1.2.0. ### Workarounds If you cannot upgrade immediately: - If you do run remote data planes, restrict reachability of the external gateway endpoint to known data-plane source addresses only (firewall / gateway-level allowlisting).

Read the publisher's advisory

osv · GO-2026-6362

Published

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Risk history

Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.

When does an EPSS score appear as a change?

A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.

Advisory history

14 saved versions

See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.

How advisory history works

Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.

15 Nov 2026 18:58:27 UTC