https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 11:41:27 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-73841 <p>OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.</p> <p>OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-73841 https://vulnerability.circl.lu/vuln/ghsa-52gf-6rpq-fgmx <p><strong>Affected:</strong> Go: github.com/openchoreo/openchoreo</p> <p>### Summary</p> <p>The OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the authorization engine decided purely from the caller-supplied resource hierarchy — the component&#39;s real owning project was never checked. As a result, an authenticated user who holds a project-scoped exec or log-viewing grant on any single project could run commands in, and read the wirelogs of, components owned by other projects in the same namespace.</p> <p>### Impact</p> <p>An authenticated tenant holding a project-scoped `component:exec` grant on just one project can execute arbitrary commands — including an interactive shell — inside the running pods of components owned by any other project in the same namespace. This exposes those workloads&#39; environment variables and mounted Secrets (such as database credentials, API keys, and tokens), allows tampering with the workload, and enables further pivoting using the workload&#39;s own network position and credentials. The same flaw in the wirelogs endpoint lets a project-scoped `wirelogs:view` grant read any component&#39;s wirelogs in the namespace.</p> <p>The blast radius is every component in the namespace, reachable from a single legitimate project grant. The boundary crossed is project-within-namespace: the request still pins the namespace, so the issu…</p> <p><strong>Affected:</strong> Go: github.com/openchoreo/openchoreo</p> <p>### Summary</p> <p>The OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the authorization engine decided purely from the caller-supplied resource hierarchy — the component&#39;s real owning project was never checked. As a result, an authenticated user who holds a project-scoped exec or log-viewing grant on any single project could run commands in, and read the wirelogs of, components owned by other projects in the same namespace.</p> <p>### Impact</p> <p>An authenticated tenant holding a project-scoped `component:exec` grant on just one project can execute arbitrary commands — including an interactive shell — inside the running pods of components owned by any other project in the same namespace. This exposes those workloads&#39; environment variables and mounted Secrets (such as database credentials, API keys, and tokens), allows tampering with the workload, and enables further pivoting using the workload&#39;s own network position and credentials. The same flaw in the wirelogs endpoint lets a project-scoped `wirelogs:view` grant read any component&#39;s wirelogs in the namespace.</p> <p>The blast radius is every component in the namespace, reachable from a single legitimate project grant. The boundary crossed is project-within-namespace: the request still pins the namespace, so the issu…</p> https://vulnerability.circl.lu/vuln/ghsa-52gf-6rpq-fgmx