CVE-2026-73843

9.6 Critique

Publiée le 14/08/2026 à 00:17 · Modifiée le 08/09/2026 à 22:56 · Analyse NVD reportée · Source : security-advisories@github.com

Description

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.

Traduire en français

Produits concernés

openchoreo

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.6 Critique	security-advisories@github.com	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-306
CWE-668
CWE-862

Références

https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce
https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a
https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f
https://github.com/openchoreo/openchoreo/pull/4122
https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2
https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2
https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories