Description
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.
Published: 2026-08-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows a user with a project‑scoped grant to execute arbitrary commands and view wirelogs on components belonging to other projects within the same namespace. This results in a loss of confidentiality, integrity, and availability for those components and can be used to fully compromise the host environment. The weakness stems from improper validation of the project query parameter, aligning with CWE‑639 and CWE‑863.

Affected Systems

OpenChoreo, the open‑source developer platform for Kubernetes. Versions from 1.2.0‑rc.1 up to but excluding 1.2.0 are affected; the issue was fixed in 1.2.0.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity flaw. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves sending crafted requests to the openchoreo‑api exec and wirelogs endpoints over the network; as the vulnerable endpoint uses the caller‑supplied project query parameter it can be abused by attackers who can reach the API, for example, via an exposed service or an insider with limited permissions. Containment requires preventing cross‑project API access or applying the vendor fix.

Generated by OpenCVE AI on August 14, 2026 at 01:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to OpenChoreo version 1.2.0 or later to apply the security fix.
  • Restrict the exec and wirelogs API endpoints to users with explicit permission, configuring RBAC or equivalent controls.
  • Consider imposing network segregation or firewall rules to limit exposure of the OpenChoreo API services to internal users only.

Generated by OpenCVE AI on August 14, 2026 at 01:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0. OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.
References

Sat, 15 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Openchoreo
Openchoreo openchoreo
Vendors & Products Openchoreo
Openchoreo openchoreo

Thu, 13 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0.
Title OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
Weaknesses CWE-639
CWE-863
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Openchoreo Openchoreo
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-14T16:10:29.515Z

Reserved: 2026-08-13T17:44:28.642Z

Link: CVE-2026-73841

cve-icon Vulnrichment

Updated: 2026-08-14T16:10:24.342Z

cve-icon NVD

Status : Received

Published: 2026-08-13T22:17:28.900

Modified: 2026-08-14T17:20:36.590

Link: CVE-2026-73841

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T12:14:31Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

  • CWE-863

    Incorrect Authorization