Listen to this Post
The OpenChoreo control-plane cluster-gateway contained a critical vulnerability that allowed unauthenticated remote attackers to invoke privileged data-plane operations. The flaw existed in the `internal/cluster-gateway/server.go` component, where the caller-facing management APIs were served on the same network listener that accepted data-plane agent connections. In multi-cluster topologies, this listener was published outside the cluster to enable remote data-plane agents to connect. However, the management APIs exposed on this externally reachable listener did not authenticate the calling client.
An attacker able to reach this endpoint could invoke `/api/proxy/` and `/api/exec/` operations without any authentication. The `/api/proxy/` endpoint allowed the attacker to proxy the data-plane Kubernetes API, effectively intercepting and manipulating communications between cluster components. The `/api/exec/` endpoint enabled command execution directly inside workload pods. These operations are normally restricted to the OpenChoreo API server and gated by its authorization mechanisms.
The exposure applied specifically to multi-cluster and remote data-plane topologies where the cluster-gateway was published outside the cluster. Deployments that did not publish the cluster-gateway externally were not affected. The vulnerability is fixed in versions 1.0.2, 1.1.2, and 1.2.0. The patch moves the caller-facing management APIs onto a separate internal listener that is not published outside the cluster, leaving only the agent-connection endpoint on the externally reachable listener. Upgrading is non-disruptive and requires no data-plane agent or configuration changes beyond the standard chart upgrade.
DailyCVE Form:
Platform: OpenChoreo control-plane
Version: <1.0.2, <1.1.2
Vulnerability: Authentication bypass
Severity: Critical
Date: 2026-08-14
Prediction: Already patched
What Undercode Say:
Check OpenChoreo version
kubectl get deployment openchoreo-control-plane -o jsonpath='{.spec.template.spec.containers[bash].image}'
Verify cluster-gateway service exposure
kubectl get svc openchoreo-cluster-gateway -o yaml
Test for unauthenticated access to management APIs
curl -k https://<gateway-external-ip>/api/proxy/
curl -k https://<gateway-external-ip>/api/exec/
Exploit: (Educational Purposes!)
An attacker with network reachability to the externally published cluster-gateway endpoint can perform the following actions without authentication:
– Proxy the data-plane Kubernetes API via `/api/proxy/` to read cluster resources, Secrets, and configuration
– Execute arbitrary commands inside workload pods via `/api/exec/`
– View wirelogs via `/api/wirelogs/` to extract sensitive data
– Mutate workloads and deploy malicious containers
– Move laterally across multiple Kubernetes environments in multi-cluster deployments
Protection:
- Upgrade to OpenChoreo 1.0.2, 1.1.2, or 1.2.0 immediately
- If upgrade is not possible, restrict reachability of the external gateway endpoint to known data-plane source addresses only using firewall or gateway-level allowlisting
- Apply network policies to limit access to the cluster-gateway listener
- Enable audit logging to detect unauthorized proxy and execution API calls
- Conduct security assessments to identify potential exploitation that may have occurred before patching
Impact:
Full compromise of workloads on the affected data plane, including:
– Disclosure of sensitive data and Kubernetes Secrets
– Tampering with workloads and cluster resources
– Denial of service through workload disruption
– Arbitrary command execution inside pods
– Lateral movement across connected data planes
– Credential harvesting and infrastructure compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
