The vulnerability allows a user with a project‑scoped grant to execute commands on and read wirelogs from components that belong to other projects within the same namespace. This occurs because the exec and wirelogs endpoints authorize the component:exec and wirelogs:view permissions based on the caller‑supplied project query parameter instead of the true owner project name. The flaw permits remote command execution and the disclosure of sensitive runtime information, which may lead to host compromise and privilege escalation. It is related to the improper authorization decisions identified in CWE‑639 and CWE‑863.

OpenChoreo, an open‑source developer platform for Kubernetes. Versions released prior to 1.1.6 and prior to 1.2.3 are affected; the issue was fixed in 1.1.6 and 1.2.3.

The CVSS score of 8.8 indicates a high severity flaw. The EPSS score is < 1%, suggesting a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves a network‑bound attacker sending crafted requests to the openchoreo‑api exec and wirelogs endpoints; the only prerequisite is access to the API service, which could occur via an exposed service or an insider with limited permissions. Note that the potential for host compromise resulting from remote command execution is inferred and not explicitly stated in the CVE data. The security fix is included in versions 1.1.6 and 1.2.3 and later. Prevention requires restricting cross‑project API access and applying the vendor patch.