{"vulnerability": "CVE-2026-73842", "sightings": [{"uuid": "2a30469c-58d6-4fd0-9a78-a641eb95cdd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4v4w7idc24", "content": "CVE-2026-73842\nOpenChoreo, a Kubernetes developer platform, had a security flaw that allowed anyone on the same network to access sensitive data, make changes to workloads, and execute commands. This flaw has been fixed in\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T14:30:03.551409Z"}, {"uuid": "9a706f4a-ee1d-4c0e-ac93-8a292384b732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyqq3ibuy27", "content": "\ud83d\udd34 CVE-2026-73842 - Critical (9)\n\nOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73842/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T23:00:39.262329Z"}, {"uuid": "821e54f7-c9ea-4c5e-86fd-248bd7550f18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyraxbbzd2y", "content": "CVE-2026-73842 - openchoreo\nOpenChoreo, a Kubernetes platform, had a security issue where anyone could access sensitive information and make changes to connected systems. This has been fixed in versions 1.0.3,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openchoreo #CVE #infosec", "creation_timestamp": "2026-08-13T23:10:04.465812Z"}, {"uuid": "ebd8eb28-34e7-4da7-bc53-bbb152a8c4a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://gist.github.com/alon710/e3fcd961ce3e45afd531f9a1d48bb4cf", "content": "# CVE-2026-73842: CVE-2026-73842: Missing Authentication and Authorization on Internal Management Listener in OpenChoreo cluster-gateway\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73842\n\n## Summary\nA critical-severity missing authentication and privilege management vulnerability was identified in the OpenChoreo cluster-gateway component. The gateway exposed internal management endpoints, including arbitrary Kubernetes proxying and execution interfaces, on an unauthenticated port. An adjacent attacker within the control-plane network can bypass RBAC controls entirely and gain administrative control over all connected data planes.\n\n## TL;DR\nOpenChoreo cluster-gateway exposed administrative routes on port 8444 without requiring authentication, enabling network-adjacent attackers to execute arbitrary commands and retrieve secrets across connected Kubernetes clusters.\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Adjacent\n- **CVSS v3.1 Score**: 9.0\n- **EPSS Score**: 0.0018 (0.18%)\n- **Exploit Status**: none\n- **CISA KEV**: No\n\n## Affected Systems\n\n- OpenChoreo cluster-gateway control-plane component\n- **OpenChoreo**: < 1.0.3 (Fixed in: `1.0.3`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.3 (Fixed in: `1.1.3`)\n- **OpenChoreo**: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: `1.2.0-rc.2`)\n\n## Mitigation\n\n- Enforce Mutual TLS (mTLS) on port 8444 with a cryptographically isolated Certificate Authority.\n- Deploy Kubernetes NetworkPolicies to restrict ingress on port 8444 to authorized control-plane components only.\n- Implement continuous log auditing to scan for unauthenticated requests directed at internal /api/ endpoints.\n\n**Remediation Steps:**\n1. Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.\n2. Verify that the Helm parameter clusterGateway.internalMtls.enabled is explicitly set to true.\n3. Deploy network isolation policy to restrict adjacent network communications targeting the gateway pod.\n\n## References\n\n- [GitHub Security Advisory GHSA-rh53-xvx2-j327](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327)\n- [OpenChoreo Pull Request 4256](https://github.com/openchoreo/openchoreo/pull/4256)\n- [OpenChoreo Pull Request 4258](https://github.com/openchoreo/openchoreo/pull/4258)\n- [OpenChoreo Pull Request 4259](https://github.com/openchoreo/openchoreo/pull/4259)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73842) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T23:32:53.766269Z"}, {"uuid": "29b51739-7d04-4162-a523-962f372235a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://gist.github.com/alon710/e3fcd961ce3e45afd531f9a1d48bb4cf", "content": "# CVE-2026-73842: CVE-2026-73842: Missing Authentication and Authorization on Internal Management Listener in OpenChoreo cluster-gateway\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73842\n\n## Summary\nA critical-severity missing authentication and privilege management vulnerability was identified in the OpenChoreo cluster-gateway component. The gateway exposed internal management endpoints, including arbitrary Kubernetes proxying and execution interfaces, on an unauthenticated port. An adjacent attacker within the control-plane network can bypass RBAC controls entirely and gain administrative control over all connected data planes.\n\n## TL;DR\nOpenChoreo cluster-gateway exposed administrative routes on port 8444 without requiring authentication, enabling network-adjacent attackers to execute arbitrary commands and retrieve secrets across connected Kubernetes clusters.\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Adjacent\n- **CVSS v3.1 Score**: 9.0\n- **EPSS Score**: 0.0018 (0.18%)\n- **Exploit Status**: none\n- **CISA KEV**: No\n\n## Affected Systems\n\n- OpenChoreo cluster-gateway control-plane component\n- **OpenChoreo**: < 1.0.3 (Fixed in: `1.0.3`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.3 (Fixed in: `1.1.3`)\n- **OpenChoreo**: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: `1.2.0-rc.2`)\n\n## Mitigation\n\n- Enforce Mutual TLS (mTLS) on port 8444 with a cryptographically isolated Certificate Authority.\n- Deploy Kubernetes NetworkPolicies to restrict ingress on port 8444 to authorized control-plane components only.\n- Implement continuous log auditing to scan for unauthenticated requests directed at internal /api/ endpoints.\n\n**Remediation Steps:**\n1. Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.\n2. Verify that the Helm parameter clusterGateway.internalMtls.enabled is explicitly set to true.\n3. Deploy network isolation policy to restrict adjacent network communications targeting the gateway pod.\n\n## References\n\n- [GitHub Security Advisory GHSA-rh53-xvx2-j327](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327)\n- [OpenChoreo Pull Request 4256](https://github.com/openchoreo/openchoreo/pull/4256)\n- [OpenChoreo Pull Request 4258](https://github.com/openchoreo/openchoreo/pull/4258)\n- [OpenChoreo Pull Request 4259](https://github.com/openchoreo/openchoreo/pull/4259)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73842) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T00:01:05.887056Z"}]}