CVE-2026-73667 openchoreo CVE debrief

Who should care

Defenders responsible for OpenChoreo Workflow Plane deployments, especially those using privileged Podman templates, should assess exposure and remediate to fixed versions. OpenChoreo Workflow Plane deployments using affected versions and privileged Podman templates are at risk. Defenders should verify exposure and remediate to OpenChoreo versions 1.0.4, 1.1.4, or 1.2.0-rc.2. Security teams and vulnerability management teams should prioritize verifying and

Why it matters

CVE-2026-73667 allows arbitrary command execution in OpenChoreo Workflow Plane deployments using affected versions and privileged Podman templates. Defenders should verify exposure and remediate to fixed versions.

• Verify exposure in OpenChoreo Workflow Plane deployments.
• Remediate to OpenChoreo versions 1.0.4, 1.1.4, or 1.2.0-rc.2.
• Monitor workflow pods for suspicious activity.

Technical summary

OpenChoreo Workflow Plane templates interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This vulnerability allows for arbitrary command execution in workflow pods when using affected versions and privileged Podman templates. The issue is fixed in OpenChoreo versions 1.0.4, 1.1.4, and 1.2.0-rc.2. Defenders should prioritize verifying exposure in OpenChoreo Workflow Plane deployments, especially those using privileged Podman templates, and remediate to fixed versions.

Defensive priority

Defenders should prioritize verifying exposure in OpenChoreo Workflow Plane deployments, especially those using privileged Podman templates, and remediate to versions 1.0.4, 1.1.4, or 1.2.0-rc.2.

Recommended defensive actions

• Verify OpenChoreo Workflow Plane deployments for exposure, especially those using privileged Podman templates.
• Remediate to OpenChoreo versions 1.0.4, 1.1.4, or 1.2.0-rc.2.
• Monitor workflow pods for suspicious activity.
• Review and update Podman templates to ensure hostUsers: false is set.
• Perform a thorough review of current workflow pods for any signs of compromise.
• Implement additional monitoring for workflow pods to detect potential malicious activity.
• Coordinate with OpenChoreo support or vendors for assistance with remediation and verification.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence of exploitation is not provided. The issue is fixed in specified versions. Defenders should verify exposure and remediate to OpenChoreo versions 1.0.4, 1.1.4, or 1.2.0-rc.2. Evidence limits are based on available information from the CVE record and NVD entry. No additional evidence of exploitation or affected deployments is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.