CVE-2026-73843 in OpenChoreo
Summary
by MITRE • 08/14/2026
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The OpenChoreo platform presents a critical security vulnerability that stems from insufficient authentication mechanisms within its cluster gateway server component. This flaw exists in the internal/cluster-gateway/server.go file where management APIs are exposed on externally reachable agent listener endpoints. The vulnerability affects versions prior to 1.0.2 and 1.1.2, creating a pathway for unauthorized network attackers to exploit the system through specifically targeted API endpoints.
The technical implementation of this vulnerability allows attackers to invoke two primary operations through the exposed endpoints. The /api/proxy/ endpoint enables attackers to proxy data-plane Kubernetes API calls, effectively allowing them to intercept and manipulate communications between cluster components. Additionally, the /api/exec/ endpoint provides the capability to execute commands directly within workload pods, which represents a severe privilege escalation opportunity. These operations become particularly dangerous in multi-cluster deployments where attackers can potentially move laterally across multiple Kubernetes environments.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it fundamentally compromises the security boundaries of Kubernetes clusters managed through OpenChoreo. Attackers who successfully exploit this flaw can execute arbitrary commands within pods, potentially leading to data exfiltration, service disruption, or even complete cluster compromise. The proxy functionality allows for continuous monitoring of cluster communications and can facilitate more sophisticated attacks such as credential harvesting or lateral movement within the infrastructure.
This vulnerability maps directly to CWE-285 (Improper Authorization) and aligns with several ATT&CK techniques including T1071.004 (Application Layer Protocol: DNS), T1059 (Command and Scripting Interpreter), and T1046 (Network Service Scanning). The attack surface is particularly concerning because it leverages the platform's intended functionality to create unauthorized access paths rather than exploiting traditional software bugs.
The remediation approach requires immediate deployment of versions 1.0.2 and 1.1.2, which implement proper authentication mechanisms for the exposed endpoints. Organizations should also conduct thorough security assessments of their OpenChoreo installations to identify any potential exploitation that may have occurred before patching. Network segmentation strategies should be reviewed to minimize the exposure of management interfaces, and access controls should be implemented to ensure that only authorized entities can reach these endpoints. Additionally, monitoring should be enhanced to detect unusual patterns in proxy and execution API calls that could indicate exploitation attempts.