CVE-2026-73667High· 8.8▾ TwilightOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workf…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
Last analysed / modified upstream
0.6% → 0.9%
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/openchoreo/openchoreo < 1.0.4github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.4github.com/openchoreo/openchoreo >= 1.2.0-rc.1, < 1.2.0-rc.2Patched in:
github.com/openchoreo/openchoreo 1.0.4github.com/openchoreo/openchoreo 1.1.4github.com/openchoreo/openchoreo 1.2.0-rc.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73841High· 8.8OpenChoreo is a complete, open-source developer platform for Kubernetes
CVE-2026-73842Critical· 9.0OpenChoreo is a complete, open-source developer platform for Kubernetes
CVE-2026-73840Medium· 5.3OpenChoreo is a complete, open-source developer platform for Kubernetes
CVE-2026-113727High· 7.4OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
CVE-2026-73843Critical· 9.6OpenChoreo is a complete, open-source developer platform for Kubernetes
CVE-2022-33186Critical· 9.8A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling …