PT-2026-71926

CVE-2026-73843

Published

2026-08-13

Updated

2026-09-21

Description by

CVSS 3.1

9.6

Critical

MetricsAV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.2 OpenChoreo versions prior to 1.1.2

Description Management APIs served by internal/cluster-gateway/server.go on the externally reachable agent listener lack authentication. This allows network-reachable attackers to invoke the '/api/proxy/' and '/api/exec/' endpoints, proxy the data-plane Kubernetes API, and execute commands within workload pods in multi-cluster deployments.

Recommendations Update to version 1.0.2. Update to version 1.1.2.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-668: Exposure of Resource to Wrong Sphere

CWE-862: Missing Authorization

CWE-306: Missing Authentication for Critical Function

Related identifiers