CVE-2026-73841High· 8.8▾ TwilightOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:vi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.8%
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/openchoreo/openchoreo >= 1.2.0-m.1, < 1.2.3github.com/openchoreo/openchoreo < 1.1.6Patched in:
github.com/openchoreo/openchoreo 1.2.3github.com/openchoreo/openchoreo 1.1.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113727High· 7.4OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
CVE-2026-73667High· 8.8OpenChoreo is a complete, open-source developer platform for Kubernetes
CVE-2026-73842Critical· 9.0OpenChoreo is a complete, open-source developer platform for Kubernetes
CVE-2026-73843Critical· 9.6OpenChoreo is a complete, open-source developer platform for Kubernetes
CVE-2026-73840Medium· 5.3OpenChoreo is a complete, open-source developer platform for Kubernetes
CVE-2026-102663Medium· 4.3OpenList is a file list program that supports multiple storage backends