https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 12 Sep 2026 17:00:48 +0000 https://vulnerability.circl.lu/sighting/6536debc-ce51-4675-862c-5905a7aa42be/export {"uuid": "6536debc-ce51-4675-862c-5905a7aa42be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://gist.github.com/alon710/4cc3ecb49324472f51ec38f524b61b28", "content": "# CVE-2026-73843: CVE-2026-73843: Critical Missing Authentication and Privilege Escalation in OpenChoreo Cluster Gateway\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73843\n\n## Summary\nPrior to versions 1.0.2 and 1.1.2, OpenChoreo's cluster gateway combined public agent traffic and administrative control-plane APIs on a single TCP port (8443). Exposing this port allowed external unauthenticated actors to access sensitive proxy and execution interfaces.\n\n## TL;DR\nOpenChoreo allowed unauthenticated remote command execution and API proxying in target Kubernetes clusters due to sharing public and private ports on the same gateway multiplexer.\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-668\n- **Attack Vector**: Adjacent Network\n- **CVSS Severity**: 9.6 (Critical)\n- **EPSS Score**: 0.00291\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo Control Plane\n- OpenChoreo Cluster Gateway\n- **OpenChoreo**: < 1.0.2 (Fixed in: `1.0.2`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.2 (Fixed in: `1.1.2`)\n\n## Mitigation\n\n- Upgrade OpenChoreo to version 1.0.2 or 1.1.2\n- Apply Kubernetes NetworkPolicies to isolate internal-api port 8444\n- Audit Helm deployments and Ingress rules to verify port separation compliance\n\n**Remediation Steps:**\n1. Identify active cluster-gateway components deployed across the infrastructure.\n2. Apply the version upgrade via Helm using official patched charts.\n3. Enforce NetworkPolicies restricting inbound traffic on target port 8444.\n4. Validate the exposure status of port 8443 and verify that /api paths return a 404 status code.\n\n## References\n\n- [GitHub Security Advisory GHSA-qh9r-j7rp-4x2m](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m)\n- [Remediation Pull Request #4122](https://github.com/openchoreo/openchoreo/pull/4122)\n- [Core Remediation Commit](https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73843) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T03:32:56.155343Z"} {"uuid": "6536debc-ce51-4675-862c-5905a7aa42be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://gist.github.com/alon710/4cc3ecb49324472f51ec38f524b61b28", "content": "# CVE-2026-73843: CVE-2026-73843: Critical Missing Authentication and Privilege Escalation in OpenChoreo Cluster Gateway\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73843\n\n## Summary\nPrior to versions 1.0.2 and 1.1.2, OpenChoreo's cluster gateway combined public agent traffic and administrative control-plane APIs on a single TCP port (8443). Exposing this port allowed external unauthenticated actors to access sensitive proxy and execution interfaces.\n\n## TL;DR\nOpenChoreo allowed unauthenticated remote command execution and API proxying in target Kubernetes clusters due to sharing public and private ports on the same gateway multiplexer.\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-668\n- **Attack Vector**: Adjacent Network\n- **CVSS Severity**: 9.6 (Critical)\n- **EPSS Score**: 0.00291\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo Control Plane\n- OpenChoreo Cluster Gateway\n- **OpenChoreo**: < 1.0.2 (Fixed in: `1.0.2`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.2 (Fixed in: `1.1.2`)\n\n## Mitigation\n\n- Upgrade OpenChoreo to version 1.0.2 or 1.1.2\n- Apply Kubernetes NetworkPolicies to isolate internal-api port 8444\n- Audit Helm deployments and Ingress rules to verify port separation compliance\n\n**Remediation Steps:**\n1. Identify active cluster-gateway components deployed across the infrastructure.\n2. Apply the version upgrade via Helm using official patched charts.\n3. Enforce NetworkPolicies restricting inbound traffic on target port 8444.\n4. Validate the exposure status of port 8443 and verify that /api paths return a 404 status code.\n\n## References\n\n- [GitHub Security Advisory GHSA-qh9r-j7rp-4x2m](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m)\n- [Remediation Pull Request #4122](https://github.com/openchoreo/openchoreo/pull/4122)\n- [Core Remediation Commit](https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73843) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T03:32:56.155343Z"} https://vulnerability.circl.lu/sighting/6536debc-ce51-4675-862c-5905a7aa42be/export Thu, 03 Sep 2026 03:32:56 +0000 https://vulnerability.circl.lu/sighting/ab83d444-3794-4869-9874-840cc20e2efd/export {"uuid": "ab83d444-3794-4869-9874-840cc20e2efd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4v4wrh3g25", "content": "CVE-2026-73843\nOpenChoreo's management APIs are exposed without a password, allowing anyone with network access to manipulate data in Kubernetes clusters. This can lead to unauthorized access to sensitive data and potential\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T14:30:04.084409Z"} {"uuid": "ab83d444-3794-4869-9874-840cc20e2efd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4v4wrh3g25", "content": "CVE-2026-73843\nOpenChoreo's management APIs are exposed without a password, allowing anyone with network access to manipulate data in Kubernetes clusters. This can lead to unauthorized access to sensitive data and potential\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T14:30:04.084409Z"} https://vulnerability.circl.lu/sighting/ab83d444-3794-4869-9874-840cc20e2efd/export Sat, 15 Aug 2026 14:30:04 +0000 https://vulnerability.circl.lu/sighting/d3ebb238-9c06-454e-b9ea-f259f64e0e92/export {"uuid": "d3ebb238-9c06-454e-b9ea-f259f64e0e92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyraynown2e", "content": "CVE-2026-73843 - openchoreo\nA security issue in OpenChoreo, a developer platform for Kubernetes, allowed attackers to access sensitive data and execute commands in workload pods without a password. This issue has\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openchoreo #CVE #infosec", "creation_timestamp": "2026-08-13T23:10:05.794684Z"} {"uuid": "d3ebb238-9c06-454e-b9ea-f259f64e0e92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyraynown2e", "content": "CVE-2026-73843 - openchoreo\nA security issue in OpenChoreo, a developer platform for Kubernetes, allowed attackers to access sensitive data and execute commands in workload pods without a password. This issue has\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openchoreo #CVE #infosec", "creation_timestamp": "2026-08-13T23:10:05.794684Z"} https://vulnerability.circl.lu/sighting/d3ebb238-9c06-454e-b9ea-f259f64e0e92/export Thu, 13 Aug 2026 23:10:05 +0000 https://vulnerability.circl.lu/sighting/e8e0d448-927a-4fdb-b005-57e67093827a/export {"uuid": "e8e0d448-927a-4fdb-b005-57e67093827a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyqqcn7xv2l", "content": "\ud83d\udd34 CVE-2026-73843 - Critical (9.6)\n\nOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73843/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T23:00:46.664363Z"} {"uuid": "e8e0d448-927a-4fdb-b005-57e67093827a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyqqcn7xv2l", "content": "\ud83d\udd34 CVE-2026-73843 - Critical (9.6)\n\nOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73843/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T23:00:46.664363Z"} https://vulnerability.circl.lu/sighting/e8e0d448-927a-4fdb-b005-57e67093827a/export Thu, 13 Aug 2026 23:00:46 +0000