{"vulnerability": "cve-2026-73843", "sightings": [{"uuid": "ab83d444-3794-4869-9874-840cc20e2efd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4v4wrh3g25", "content": "CVE-2026-73843\nOpenChoreo's management APIs are exposed without a password, allowing anyone with network access to manipulate data in Kubernetes clusters. This can lead to unauthorized access to sensitive data and potential\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T14:30:04.084409Z"}, {"uuid": "e8e0d448-927a-4fdb-b005-57e67093827a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msyqqcn7xv2l", "content": "\ud83d\udd34 CVE-2026-73843 - Critical (9.6)\n\nOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73843/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T23:00:46.664363Z"}, {"uuid": "d3ebb238-9c06-454e-b9ea-f259f64e0e92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msyraynown2e", "content": "CVE-2026-73843 - openchoreo\nA security issue in OpenChoreo, a developer platform for Kubernetes, allowed attackers to access sensitive data and execute commands in workload pods without a password. This issue has\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openchoreo #CVE #infosec", "creation_timestamp": "2026-08-13T23:10:05.794684Z"}, {"uuid": "6536debc-ce51-4675-862c-5905a7aa42be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://gist.github.com/alon710/4cc3ecb49324472f51ec38f524b61b28", "content": "# CVE-2026-73843: CVE-2026-73843: Critical Missing Authentication and Privilege Escalation in OpenChoreo Cluster Gateway\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73843\n\n## Summary\nPrior to versions 1.0.2 and 1.1.2, OpenChoreo's cluster gateway combined public agent traffic and administrative control-plane APIs on a single TCP port (8443). Exposing this port allowed external unauthenticated actors to access sensitive proxy and execution interfaces.\n\n## TL;DR\nOpenChoreo allowed unauthenticated remote command execution and API proxying in target Kubernetes clusters due to sharing public and private ports on the same gateway multiplexer.\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-668\n- **Attack Vector**: Adjacent Network\n- **CVSS Severity**: 9.6 (Critical)\n- **EPSS Score**: 0.00291\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo Control Plane\n- OpenChoreo Cluster Gateway\n- **OpenChoreo**: < 1.0.2 (Fixed in: `1.0.2`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.2 (Fixed in: `1.1.2`)\n\n## Mitigation\n\n- Upgrade OpenChoreo to version 1.0.2 or 1.1.2\n- Apply Kubernetes NetworkPolicies to isolate internal-api port 8444\n- Audit Helm deployments and Ingress rules to verify port separation compliance\n\n**Remediation Steps:**\n1. Identify active cluster-gateway components deployed across the infrastructure.\n2. Apply the version upgrade via Helm using official patched charts.\n3. Enforce NetworkPolicies restricting inbound traffic on target port 8444.\n4. Validate the exposure status of port 8443 and verify that /api paths return a 404 status code.\n\n## References\n\n- [GitHub Security Advisory GHSA-qh9r-j7rp-4x2m](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m)\n- [Remediation Pull Request #4122](https://github.com/openchoreo/openchoreo/pull/4122)\n- [Core Remediation Commit](https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73843) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T03:32:56.155343Z"}]}