CVE-2026-73843: Openchoreo

Critical severity, CVSS 9.6. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.

Affected products

• Openchoreo Openchoreo: before 1.0.2 (fixed in 1.0.2); from 1.1.0, before 1.1.2 (fixed in 1.1.2)

Published 2026-08-13. Last modified 2026-09-08.