Vulnerability-Lookup

GHSA-52GF-6RPQ-FGMX

Vulnerability from github – Published: 2026-09-02 23:44 – Updated: 2026-09-02 23:44

Summary

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Details

Summary

The OpenChoreo API server (openchoreo-api) authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the authorization engine decided purely from the caller-supplied resource hierarchy — the component's real owning project was never checked. As a result, an authenticated user who holds a project-scoped exec or log-viewing grant on any single project could run commands in, and read the wirelogs of, components owned by other projects in the same namespace.

Impact

An authenticated tenant holding a project-scoped component:exec grant on just one project can execute arbitrary commands — including an interactive shell — inside the running pods of components owned by any other project in the same namespace. This exposes those workloads' environment variables and mounted Secrets (such as database credentials, API keys, and tokens), allows tampering with the workload, and enables further pivoting using the workload's own network position and credentials. The same flaw in the wirelogs endpoint lets a project-scoped wirelogs:view grant read any component's wirelogs in the namespace.

The blast radius is every component in the namespace, reachable from a single legitimate project grant. The boundary crossed is project-within-namespace: the request still pins the namespace, so the issue does not cross namespace boundaries. In effect this is a cross-project (cross-team) remote command-execution and data-access primitive available to any low-privileged tenant.

Patches

Fixed in 1.2.3 and 1.1.6. The fix aligns the exec and wirelogs endpoints with the pattern already used by other first-class component operations: the target component is fetched first and authorization is evaluated against its real owning project (comp.Spec.Owner.ProjectName) instead of the caller-supplied project query parameter.

Workarounds

If you cannot upgrade immediately:

Restrict component:exec and wirelogs:view grants to trusted operators only. Any holder of such a grant on any project can reach every component in the same namespace.
Where stronger isolation is required, separate sensitive components into their own namespaces, since the flaw does not cross namespace boundaries.

Related advisories

GHSA-rh53-xvx2-j327 — the cluster-gateway internal proxy applies no caller authorization, so this API-layer authorization bypass reaches the data-plane Kubernetes API with no compensating control: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327
GHSA-c5f6-2rm9-2w8g — reported together as part of the same review.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openchoreo/openchoreo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0-m.1"
            },
            {
              "fixed": "1.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openchoreo/openchoreo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T23:44:51Z",
    "nvd_published_at": "2026-08-13T22:17:28Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the authorization engine decided purely from the caller-supplied resource hierarchy \u2014 the component\u0027s real owning project was never checked. As a result, an authenticated user who holds a project-scoped exec or log-viewing grant on any single project could run commands in, and read the wirelogs of, components owned by other projects in the same namespace.\n\n### Impact\n\nAn authenticated tenant holding a project-scoped `component:exec` grant on just one project can execute arbitrary commands \u2014 including an interactive shell \u2014 inside the running pods of components owned by any other project in the same namespace. This exposes those workloads\u0027 environment variables and mounted Secrets (such as database credentials, API keys, and tokens), allows tampering with the workload, and enables further pivoting using the workload\u0027s own network position and credentials. The same flaw in the wirelogs endpoint lets a project-scoped `wirelogs:view` grant read any component\u0027s wirelogs in the namespace.\n\nThe blast radius is every component in the namespace, reachable from a single legitimate project grant. The boundary crossed is project-within-namespace: the request still pins the namespace, so the issue does not cross namespace boundaries. In effect this is a cross-project (cross-team) remote command-execution and data-access primitive available to any low-privileged tenant.\n\n### Patches\n\nFixed in **1.2.3** and **1.1.6**. The fix aligns the exec and wirelogs endpoints with the pattern already used by other first-class component operations: the target component is fetched first and authorization is evaluated against its real owning project (`comp.Spec.Owner.ProjectName`) instead of the caller-supplied `project` query parameter.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Restrict `component:exec` and `wirelogs:view` grants to trusted operators only. Any holder of such a grant on any project can reach every component in the same namespace.\n- Where stronger isolation is required, separate sensitive components into their own namespaces, since the flaw does not cross namespace boundaries.\n\n### Related advisories\n\n- `GHSA-rh53-xvx2-j327` \u2014 the cluster-gateway internal proxy applies no caller authorization, so this API-layer authorization bypass reaches the data-plane Kubernetes API with no compensating control: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327\n- `GHSA-c5f6-2rm9-2w8g` \u2014 reported together as part of the same review.",
  "id": "GHSA-52gf-6rpq-fgmx",
  "modified": "2026-09-02T23:44:51Z",
  "published": "2026-09-02T23:44:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73841"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4251"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4516"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4538"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/4d372eaf1f07525663dcca5257062f4b051b9820"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/9d77b64f747eba89247c47ebfeffec591c4cd2d8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/c9390e4fcb9953f43b07cb48197576182301593d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openchoreo/openchoreo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints"
}

CVE-2026-73841 (GCVE-0-2026-73841)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:56 – Updated: 2026-09-02 15:16

Title

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:10 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

9 references

URL	Tags
https://github.com/openchoreo/openchoreo/security…	x_refsource_CONFIRM
https://github.com/openchoreo/openchoreo/pull/4251	x_refsource_MISC
https://github.com/openchoreo/openchoreo/pull/4516	x_refsource_MISC
https://github.com/openchoreo/openchoreo/pull/4538	x_refsource_MISC
https://github.com/openchoreo/openchoreo/commit/4…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/commit/9…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/commit/c…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/releases…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
openchoreo	openchoreo	Affected: >= 1.2.0-m.1, < 1.2.3 Affected: < 1.1.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:10:15.605946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:10:29.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openchoreo",
          "vendor": "openchoreo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.2.0-m.1, \u003c 1.2.3"
            },
            {
              "status": "affected",
              "version": "\u003c 1.1.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T15:16:54.694Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/pull/4251",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/pull/4251"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/pull/4516",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/pull/4516"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/pull/4538",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/pull/4538"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/commit/4d372eaf1f07525663dcca5257062f4b051b9820",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/commit/4d372eaf1f07525663dcca5257062f4b051b9820"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/commit/9d77b64f747eba89247c47ebfeffec591c4cd2d8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/commit/9d77b64f747eba89247c47ebfeffec591c4cd2d8"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/commit/c9390e4fcb9953f43b07cb48197576182301593d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/commit/c9390e4fcb9953f43b07cb48197576182301593d"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.6"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.3"
        }
      ],
      "source": {
        "advisory": "GHSA-52gf-6rpq-fgmx",
        "discovery": "UNKNOWN"
      },
      "title": "OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73841",
    "datePublished": "2026-08-13T21:56:13.057Z",
    "dateReserved": "2026-08-13T17:44:28.642Z",
    "dateUpdated": "2026-09-02T15:16:54.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-52GF-6RPQ-FGMX

Summary

Impact

Patches

Workarounds

Related advisories

CVE-2026-73841 (GCVE-0-2026-73841)

Tags

Sightings

Nomenclature