CVE-2026-73843 openchoreo CVE debrief

Who should care

Defenders responsible for OpenChoreo deployments, especially in multi-cluster environments, should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential command execution and data-plane Kubernetes API proxying.

Why it matters

CVE-2026-73843 is a critical vulnerability in OpenChoreo that allows network-reachable attackers to invoke management APIs without authentication, potentially leading to command execution and data-plane Kubernetes API proxying in multi-cluster deployments. Defenders should prioritize patching or mitigating this vulnerability, especially in multi-cluster environments.

• Potential command execution in workload pods in multi-cluster deployments
• Potential data-plane Kubernetes API proxying by attackers
• Need for authentication mechanisms on externally reachable agent listeners
• Verification of OpenChoreo deployment configurations and security settings

Technical summary

The vulnerability in OpenChoreo allows network-reachable attackers to invoke management APIs without authentication, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This is due to internal/cluster-gateway/server.go serving caller-facing management APIs on the externally reachable agent listener without authentication. Affected deployments should prioritize patching to versions 1.0.2 or 1.1.2 and verify the security of their configurations. Defenders should assess exposure, especially in multi-cluster environments, and consider compensating controls while remediation is planned.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in multi-cluster deployments, to prevent potential command execution and data-plane Kubernetes API proxying.

Recommended defensive actions

• Patch OpenChoreo to version 1.0.2 or 1.1.2
• Verify and restrict access to the externally reachable agent listener
• Monitor for suspicious activity in multi-cluster deployments
• Review and update security configurations for OpenChoreo deployments
• Conduct a thorough review of OpenChoreo deployment configurations to ensure secure setup
• Verify network reachability and authentication mechanisms for the agent listener
• Implement additional monitoring for potential command execution and data-plane Kubernetes API proxying

Evidence notes

The CVE record and source references provide details on the vulnerability, affected versions, and fixed versions. However, the scope of affected deployments and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.