Arbitrary Command Execution Vulnerability in OpenChoreo Kubernetes Platform
CVE-2026-73667
What is CVE-2026-73667?
OpenChoreo is a comprehensive, open-source developer platform designed for Kubernetes. Prior to specific versions (1.0.4, 1.1.4, and 1.2.0-rc.2), the OpenChoreo Workflow Plane was susceptible to a serious security issue where untrusted developer-controlled parameters could be interpolated into shell program text. This misuse allowed arbitrary shell commands to be executed within workflow pods, potentially compromising the security of the whole Kubernetes environment. Privileged Podman templates were notably lacking critical configurations. The vulnerability has been addressed in the newer versions, ensuring enhanced security and safe execution of workflow templates.
Affected Version(s)
openchoreo < 1.0.4 < 1.0.4
openchoreo >= 1.1.0, < 1.1.4 < 1.1.0, 1.1.4
openchoreo >= 1.2.0-rc.1, < 1.2.0-rc.2 < 1.2.0-rc.1, 1.2.0-rc.2