CVE-2026-73842 openchoreo CVE debrief

Who should care

Kubernetes administrators and security teams using OpenChoreo should assess exposure and upgrade to fixed versions to prevent unauthorized access. They should verify the exposure of the internal listener and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should monitor for unauthorized access attempts and review and restrict network access to the internal listener.

Why it matters

CVE-2026-73842 allows unauthorized access to sensitive data and workload manipulation in OpenChoreo deployments prior to version 1.0.3, 1.1.3, or 1.2.0-rc.2.

• Potential unauthorized access to tenant Kubernetes Secrets
• Possible workload mutation across connected data planes
• Execution of commands without authentication
• Verification of internal listener exposure and access controls

Technical summary

The OpenChoreo platform had an issue where internal endpoints were exposed without authentication, allowing unauthorized access to sensitive data and workload manipulation. This issue was present in versions prior to 1.0.3, 1.1.3, and 1.2.0-rc.2. The internal/cluster-gateway/server.go file exposed certain endpoints (/api/proxy/, /api/exec/, and /api/wirelogs/) on an internal listener without requiring a client certificate or token. This allowed any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes.

Defensive priority

Defenders should prioritize verifying exposure of the internal listener and upgrading to fixed versions (1.0.3, 1.1.3, or 1.2.0-rc.2) to mitigate unauthorized access.

Recommended defensive actions

• Verify exposure of the internal listener in OpenChoreo deployments
• Upgrade to version 1.0.3, 1.1.3, or 1.2.0-rc.2
• Monitor for unauthorized access attempts
• Review and restrict network access to the internal listener
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references provide details on the affected versions and fixed releases. However, the corpus does not establish specific exploitation instances or impact scope, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.