CVE-2026-73841

Name of the Vulnerable Software and Affected Versions OpenChoreo versions 1.2.0-rc.1 through 1.2.0

Description An authorization flaw exists in the openchoreo-api where the system uses a caller-supplied project query parameter instead of the comp.Spec.Owner.ProjectName to authorize component:exec and wirelogs:view actions. This allows a user with a project-scoped grant to execute commands and read wirelogs from components belonging to other projects within the same namespace. The issue affects the following endpoints:

Recommendations Update OpenChoreo to version 1.2.0.