CVE-2026-73842 in OpenChoreo
Summary
by MITRE • 08/14/2026
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The OpenChoreo platform presents a critical authorization vulnerability that undermines the security posture of Kubernetes environments relying on its services. This flaw exists in the internal cluster gateway server component where specific API endpoints are exposed without proper authentication mechanisms. The vulnerability affects versions prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, creating a persistent security risk that allows unauthorized access to sensitive Kubernetes resources through multiple attack vectors.
The technical implementation of this vulnerability stems from insufficient access controls within the internal listener configuration. The server.go file exposes three distinct API endpoints including /api/proxy/, /api/exec/, and /api/wirelogs/ without requiring client certificates or authentication tokens. This misconfiguration creates an attack surface where any network-reachable entity can exploit these endpoints to gain unauthorized access to tenant Kubernetes Secrets, enabling data exfiltration and potential lateral movement within the cluster environment. The absence of proper authentication mechanisms directly violates fundamental security principles and creates a path for privilege escalation attacks.
The operational impact of this vulnerability extends beyond simple unauthorized access to include significant damage potential through workload manipulation and command execution capabilities. An attacker exploiting these endpoints could execute arbitrary commands across connected data planes, potentially leading to complete cluster compromise. The ability to read tenant Kubernetes Secrets exposes sensitive credentials and configuration data that could be used for further attacks against other systems or for maintaining persistence within the environment. This vulnerability directly enables techniques described in the MITRE ATT&CK framework under privilege escalation and defense evasion tactics.
Security practitioners should immediately implement mitigations including upgrading to versions 1.0.3, 1.1.3, or 1.2.0-rc.2 where authentication mechanisms have been properly implemented. Network segmentation strategies should be employed to restrict access to the internal listener ports until proper authentication is enforced. Organizations should conduct comprehensive security assessments of their OpenChoreo deployments to identify any remaining exposure points and implement additional monitoring for unauthorized access attempts. The vulnerability aligns with CWE-284 which addresses improper access control issues, specifically targeting weak authorization mechanisms in network services.
The remediation process requires careful attention to ensure that all internal listeners properly enforce authentication before granting access to sensitive endpoints. Security controls should include mandatory client certificate validation and token-based authentication for all exposed API routes. Organizations should also implement network-level restrictions using firewalls or service meshes to limit access to these internal endpoints to trusted sources only. Continuous monitoring and logging of access attempts to these endpoints should be enabled to detect potential exploitation attempts and provide forensic capabilities for incident response activities.
This vulnerability demonstrates the critical importance of proper authentication implementation in distributed systems and highlights how seemingly minor configuration oversights can create significant security risks. The exposed endpoints represent a direct pathway for attackers to compromise Kubernetes environments through privilege escalation attacks, making immediate remediation essential. Organizations utilizing OpenChoreo should treat this as a high-priority security issue requiring immediate attention to prevent potential data breaches or system compromise across their Kubernetes deployments.