Authorization Flaw in OpenChoreo's Kubernetes Platform Affects Access Control
CVE-2026-73841

8.8HIGH

Key Information:

Vendor

Openchoreo

Status
Openchoreo
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73841?

OpenChoreo, a comprehensive open-source developer platform for Kubernetes, features a significant authorization flaw present from version 1.2.0-rc.1 to 1.2.0. This vulnerability allows users with project-scoped permissions to execute commands and read wirelogs from components belonging to other projects within the same namespace. The issue arises due to the use of the caller-supplied project query parameter for authorizing access, circumventing the proper checks against the actual owner’s project name. This security loophole has been addressed in OpenChoreo version 1.2.0, where strict authorization checks are enforced.

Affected Version(s)

openchoreo >= 1.2.0-rc.1, < 1.2.0

References

https://github.com/openchoreo/openchoreo/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.