CVE-2026-73667

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.4 OpenChoreo versions prior to 1.1.4 OpenChoreo versions prior to 1.2.0-rc.2

Description OpenChoreo Workflow Plane templates located under samples/getting-started/workflow-templates/ interpolate developer-controlled workflow parameters into shell program text executed via sh -c rather than passing values through container.env. This allows the execution of arbitrary commands within workflow pods. Additionally, affected privileged Podman templates lack the hostUsers: false configuration.

Recommendations Update to version 1.0.4. Update to version 1.1.4. Update to version 1.2.0-rc.2.