Summary
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only, data-plane Secret disclosure and arbitrary Kubernetes mutation
The OpenChoreo control-plane cluster-gateway exposes internal management APIs (/api/proxy/, /api/exec/, /api/wirelogs/) that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP methods and reads of Secrets in tenant namespaces (only kube-system Secrets are blocked), so although the client library documents these requests as "read-only," the server enforces no such restriction. Any party able to reach the internal listener can, with no client certificate or token, read Secrets in any tenant namespace, create/modify/delete workloads, and exec into pods across every connected data plane.
Impact
An attacker with network access to the cluster-gateway internal listener obtains tunneled access to every connected data plane's Kubernetes API with no caller-level access control. Across all connected data planes, this allows:
- Secret disclosure, reading any Secret outside
kube-systemin any tenant namespace (database credentials, cloud/KMS keys, TLS private keys), independent of any workload ServiceAccount permissions. - Workload tampering or destruction, creating, modifying, or deleting Deployments, Services, and other resources.
- Pod command execution inside workload pods via
/api/exec/.
This is also the missing second authorization layer behind GHSA-52gf-6rpq-fgmx (the openchoreo-api exec/wirelogs cross-project authorization bypass): because the gateway provides no compensating authorization, that bypass, and any other authz gap or SSRF that reaches the internal API, reaches the data-plane Kubernetes API unchecked.
Direct exploitability depends on the network isolation of the internal listener, which is not fixed in source. Where the internal port is reachable by untrusted workloads with no restrictive NetworkPolicy, and with impact landing in a separate data-plane cluster, this is Critical; it is scored conservatively as High otherwise.
The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access. Typical impact: privilege escalation beyond the intended level.
CVE-2026-73842 has a CVSS score of 9.0 (Critical). The vector is reachable from an adjacent network, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.3, 1.1.3, 1.2.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in 1.0.3, 1.1.3, and 1.2.0. Upgrade path: 1.1.x → 1.1.2, 1.0.x and earlier → 1.0.2, 1.2.0-rc1 line → 1.2.0.
Frequently Asked Questions
- What is CVE-2026-73842? CVE-2026-73842 is a critical-severity improper privilege management vulnerability in github.com/openchoreo/openchoreo (go), affecting versions < 1.0.3. It is fixed in 1.0.3, 1.1.3, 1.2.0. The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access.
- How severe is CVE-2026-73842? CVE-2026-73842 has a CVSS score of 9.0 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/openchoreo/openchoreo are affected by CVE-2026-73842? github.com/openchoreo/openchoreo (go) versions < 1.0.3 is affected.
- Is there a fix for CVE-2026-73842? Yes. CVE-2026-73842 is fixed in 1.0.3, 1.1.3, 1.2.0. Upgrade to this version or later.
- Is CVE-2026-73842 exploitable, and should I be worried? Whether CVE-2026-73842 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-73842 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-73842?
- Upgrade
github.com/openchoreo/openchoreoto 1.0.3 or later - Upgrade
github.com/openchoreo/openchoreoto 1.1.3 or later - Upgrade
github.com/openchoreo/openchoreoto 1.2.0 or later
- Upgrade