OpenChoreo Kubernetes Platform Vulnerability Exposes API Without Authentication
CVE-2026-73666
What is CVE-2026-73666?
A security misconfiguration in OpenChoreo prior to versions 1.0.4, 1.1.4, and 1.2.1 allows an attacker to exploit hardcoded authentication policies. Specifically, the 'backend.auth.dangerouslyDisableDefaultAuthPolicy' and 'auth.providers.guest.dangerouslyAllowOutsideDevelopment' values are set to true, leaving sensitive API endpoints open for unauthenticated access. This oversight permits unauthorized operations such as reading catalog data, accessing scaffolder logs, and manipulating catalog locations, underscoring the critical need for appropriate access control measures in development platforms.
Affected Version(s)
backstage-plugins < 1.0.4 < 1.0.4
backstage-plugins >= 1.1.0, < 1.1.4 < 1.1.0, 1.1.4
backstage-plugins >= 1.2.0-rc.1, < 1.2.1 < 1.2.0-rc.1, 1.2.1