These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-73843 is a critical vulnerability in OpenChoreo, a complete, open-source developer platform for Kubernetes. The vulnerability allows network-reachable attackers to invoke management APIs without authentication, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.
OpenChoreo, a complete open-source developer platform for Kubernetes, had an issue in versions prior to 1.0.3, 1.1.3, and 1.2.0-rc.2. The internal/cluster-gateway/server.go file exposed certain endpoints (/api/proxy/, /api/exec/, and /api/wirelogs/) on an internal listener without requiring a client certificate or token. This allowed any network-reachable caller to read tenant Kubernetes Secrets, mutate w [truncated]
The OpenChoreo platform, a complete open-source developer platform for Kubernetes, is vulnerable to unauthorized command execution and wirelog access. This vulnerability, tracked as CVE-2026-73841, stems from improper authorization in internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go. Specifically, the platform incorrectly uses the caller-supplied project qu [truncated]
CVE-2026-73840 is a vulnerability in OpenChoreo, an open-source developer platform for Kubernetes. The POST /api/v1alpha1/autobuild endpoint is vulnerable to unauthenticated build triggers due to improper validation of the X-Event-Key header and insufficient authentication for Bitbucket requests. This allows for potential unauthorized builds, supply chain attacks, and denial-of-service attacks. Kubernetes [truncated]
OpenChoreo Workflow Plane templates interpolated developer-controlled workflow parameters into shell program text executed through sh -c, allowing arbitrary commands to run in workflow pods. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2. The vulnerability allows for arbitrary command execution in workflow pods when using affected versions and privileged Podman templates. Defenders should as [truncated]
CVE-2026-73666 debrief based on the supplied source corpus. The CVE record was published on 2026-08-13T22:17:28.393Z and has not been modified since then. OpenChoreo Backstage backend instances prior to 1.0.4, 1.1.4, and 1.2.1 have hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication. This all [truncated]