CVE-2026-73667 in OpenChoreo
Summary
by MITRE • 08/14/2026
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability identified in OpenChoreo affects the Workflow Plane template processing functionality within the platform's samples directory, specifically targeting versions prior to 1.0.4, 1.1.4, and 1.2.0-rc.2. This security flaw stems from improper handling of developer-controlled parameters within workflow templates, creating a critical command injection vulnerability that can be exploited by malicious actors. The issue manifests when the system interpolates user-provided parameters directly into shell commands executed via sh -c, bypassing proper input validation and sanitization mechanisms.
The technical implementation of this vulnerability involves the direct concatenation of untrusted input values into shell execution contexts without appropriate escaping or parameterization. When developers create workflow templates using the affected samples, any parameter values provided by users are interpolated directly into shell command strings rather than being properly passed through container environment variables. This design flaw creates a classic command injection vector where attackers can manipulate workflow parameters to inject malicious shell commands that will execute within the workflow pods. The vulnerability is particularly severe because it operates at the pod execution level, allowing arbitrary code execution with the privileges of the running workflow processes.
The operational impact of this vulnerability extends beyond simple command injection, as it enables attackers to potentially escalate privileges and compromise the entire Kubernetes cluster. When combined with the presence of privileged Podman templates that lack the hostUsers: false configuration, the attack surface expands significantly. This combination allows an attacker to not only execute arbitrary commands within workflow pods but also potentially gain access to host-level resources, as the missing hostUsers: false setting removes important security boundaries between containerized processes and the underlying host system. The affected workflow templates are located in samples/getting-started/workflow-templates/, making them easily accessible to developers who may inadvertently use these vulnerable configurations.
This vulnerability aligns with CWE-78, which specifically addresses OS Command Injection, and represents a fundamental failure in input validation and secure coding practices within the platform's template processing engine. The issue also maps to ATT&CK technique T1059.001 for command and script injection, where adversaries use legitimate system tools to execute malicious code. Additionally, the privilege escalation aspect of this vulnerability relates to ATT&CK technique T1548.002 for abuse of sudo or other privilege escalation mechanisms, particularly when combined with the privileged container configurations. The security implications are further exacerbated by the fact that these vulnerable templates are part of the platform's getting-started samples, meaning they are likely to be used by new developers who may not fully understand the security implications of their usage.
The remediation strategy requires immediate upgrading to versions 1.0.4, 1.1.4, or 1.2.0-rc.2 where the vulnerability has been addressed. The fix implements proper parameter handling by transitioning from direct shell command interpolation to secure environment variable passing mechanisms. Organizations should also conduct comprehensive audits of their existing workflow templates to identify and remediate any custom templates that may exhibit similar patterns. Security hardening measures including strict input validation, proper parameter sanitization, and implementation of the hostUsers: false configuration in all privileged containers are essential for preventing similar vulnerabilities from emerging in the future. The fix demonstrates the importance of secure coding practices in containerized environments and highlights the critical need for proper input handling when dealing with shell execution contexts in Kubernetes-based platforms.