https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 13:21:15 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-73842 <p>OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.</p> <p>OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-73842 https://vulnerability.circl.lu/vuln/ghsa-rh53-xvx2-j327 <p><strong>Affected:</strong> Go: github.com/openchoreo/openchoreo</p> <p>### Summary</p> <p>The OpenChoreo control-plane cluster-gateway exposes internal management APIs (`/api/proxy/`, `/api/exec/`, `/api/wirelogs/`) that tunnel requests through to connected data planes&#39; Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP methods and reads of Secrets in tenant namespaces (only kube-system Secrets are blocked), so although the client library documents these requests as &#34;read-only,&#34; the server enforces no such restriction. Any party able to reach the internal listener can — with no client certificate or token — read Secrets in any tenant namespace, create/modify/delete workloads, and exec into pods across every connected data plane.</p> <p>### Impact</p> <p>An attacker with network access to the cluster-gateway internal listener obtains tunneled access to every connected data plane&#39;s Kubernetes API with no caller-level access control. Across all connected data planes, this allows:</p> <p>- Secret disclosure — reading any Secret outside `kube-system` in any tenant namespace (database credentials, cloud/KMS keys, TLS private keys), independent of any workload ServiceAccount permissions. - Workload tampering or destruction — creating, modifying, or deleting Deployments, Services, and other resources. - Pod command execution inside workload pods via `/api/exec/`.</p> <p>This is also the missing second authorization layer behind GHSA-52gf-6rpq-fgmx (the openchoreo-api exec/wirelogs cross-project authorization bypass): beca…</p> <p><strong>Affected:</strong> Go: github.com/openchoreo/openchoreo</p> <p>### Summary</p> <p>The OpenChoreo control-plane cluster-gateway exposes internal management APIs (`/api/proxy/`, `/api/exec/`, `/api/wirelogs/`) that tunnel requests through to connected data planes&#39; Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP methods and reads of Secrets in tenant namespaces (only kube-system Secrets are blocked), so although the client library documents these requests as &#34;read-only,&#34; the server enforces no such restriction. Any party able to reach the internal listener can — with no client certificate or token — read Secrets in any tenant namespace, create/modify/delete workloads, and exec into pods across every connected data plane.</p> <p>### Impact</p> <p>An attacker with network access to the cluster-gateway internal listener obtains tunneled access to every connected data plane&#39;s Kubernetes API with no caller-level access control. Across all connected data planes, this allows:</p> <p>- Secret disclosure — reading any Secret outside `kube-system` in any tenant namespace (database credentials, cloud/KMS keys, TLS private keys), independent of any workload ServiceAccount permissions. - Workload tampering or destruction — creating, modifying, or deleting Deployments, Services, and other resources. - Pod command execution inside workload pods via `/api/exec/`.</p> <p>This is also the missing second authorization layer behind GHSA-52gf-6rpq-fgmx (the openchoreo-api exec/wirelogs cross-project authorization bypass): beca…</p> https://vulnerability.circl.lu/vuln/ghsa-rh53-xvx2-j327