openchoreo has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 5. The median CVSS is 8.8 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: github.com/openchoreo/openchoreo (5), openchoreo (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- github.com/openchoreo/openchoreo 5
- openchoreo 1
Worst active — by depth score
CVE-2026-73843Critical· 9.6OpenChoreo is a complete, open-source developer platform for Kubernetes53CVE-2026-73842Critical· 9.0OpenChoreo is a complete, open-source developer platform for Kubernetes50CVE-2026-73841High· 8.8OpenChoreo is a complete, open-source developer platform for Kubernetes49CVE-2026-73667High· 8.8OpenChoreo is a complete, open-source developer platform for Kubernetes49CVE-2026-113727High· 7.4OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs41
openchoreo vulnerabilities
CVEs affecting openchoreo, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-113727High· 7.4OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the…
CVE-2026-73842Critical· 9.0OpenChoreo is a complete, open-source developer platform for Kubernetes
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requir…
CVE-2026-73843Critical· 9.6OpenChoreo is a complete, open-source developer platform for Kubernetes
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication,…
CVE-2026-73841High· 8.8OpenChoreo is a complete, open-source developer platform for Kubernetes
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:vi…
CVE-2026-73840Medium· 5.3OpenChoreo is a complete, open-source developer platform for Kubernetes
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provi…
CVE-2026-73667High· 8.8OpenChoreo is a complete, open-source developer platform for Kubernetes
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workf…