https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:09:25 +0000 https://vulnerability.circl.lu/sighting/c8f5e955-ad10-44db-82af-99c98e17f333/export {"uuid": "c8f5e955-ad10-44db-82af-99c98e17f333", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73848", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mva3eik6zg2o", "content": "CVE-2026-73848: XSS in emlog \u22642.6.29 via unescaped tag names in article editor. Attacker executes arbitrary JS via crafted tag\u2014full account takeover risk. CVSS N/A. UNPATCHED. Update or restrict editor access immediately. Details: https://www.valtersit.com/cve/CVE-2026-73848/ #CV", "creation_timestamp": "2026-09-11T07:50:03.176266Z"} {"uuid": "c8f5e955-ad10-44db-82af-99c98e17f333", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73848", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mva3eik6zg2o", "content": "CVE-2026-73848: XSS in emlog \u22642.6.29 via unescaped tag names in article editor. Attacker executes arbitrary JS via crafted tag\u2014full account takeover risk. CVSS N/A. UNPATCHED. Update or restrict editor access immediately. Details: https://www.valtersit.com/cve/CVE-2026-73848/ #CV", "creation_timestamp": "2026-09-11T07:50:03.176266Z"} https://vulnerability.circl.lu/sighting/c8f5e955-ad10-44db-82af-99c98e17f333/export Fri, 11 Sep 2026 07:50:03 +0000 https://vulnerability.circl.lu/sighting/faee0483-79f9-4527-afbe-cd72fc1e8533/export {"uuid": "faee0483-79f9-4527-afbe-cd72fc1e8533", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73848", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117251270384650825", "content": "CVE-2026-73848: XSS in emlog \u22642.6.29 via unescaped tag names in article editor. Attacker executes arbitrary JS via crafted tag\u2014full account takeover risk. CVSS N/A. UNPATCHED. Update or restrict editor access immediately. Details: https://www.valtersit.com/cve/CVE-2026-73848/ #CV", "creation_timestamp": "2026-09-11T07:40:04.343627Z"} {"uuid": "faee0483-79f9-4527-afbe-cd72fc1e8533", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73848", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117251270384650825", "content": "CVE-2026-73848: XSS in emlog \u22642.6.29 via unescaped tag names in article editor. Attacker executes arbitrary JS via crafted tag\u2014full account takeover risk. CVSS N/A. UNPATCHED. Update or restrict editor access immediately. Details: https://www.valtersit.com/cve/CVE-2026-73848/ #CV", "creation_timestamp": "2026-09-11T07:40:04.343627Z"} https://vulnerability.circl.lu/sighting/faee0483-79f9-4527-afbe-cd72fc1e8533/export Fri, 11 Sep 2026 07:40:04 +0000 https://vulnerability.circl.lu/sighting/ebd8eb28-34e7-4da7-bc53-bbb152a8c4a6/export {"uuid": "ebd8eb28-34e7-4da7-bc53-bbb152a8c4a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://gist.github.com/alon710/e3fcd961ce3e45afd531f9a1d48bb4cf", "content": "# CVE-2026-73842: CVE-2026-73842: Missing Authentication and Authorization on Internal Management Listener in OpenChoreo cluster-gateway\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73842\n\n## Summary\nA critical-severity missing authentication and privilege management vulnerability was identified in the OpenChoreo cluster-gateway component. The gateway exposed internal management endpoints, including arbitrary Kubernetes proxying and execution interfaces, on an unauthenticated port. An adjacent attacker within the control-plane network can bypass RBAC controls entirely and gain administrative control over all connected data planes.\n\n## TL;DR\nOpenChoreo cluster-gateway exposed administrative routes on port 8444 without requiring authentication, enabling network-adjacent attackers to execute arbitrary commands and retrieve secrets across connected Kubernetes clusters.\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Adjacent\n- **CVSS v3.1 Score**: 9.0\n- **EPSS Score**: 0.0018 (0.18%)\n- **Exploit Status**: none\n- **CISA KEV**: No\n\n## Affected Systems\n\n- OpenChoreo cluster-gateway control-plane component\n- **OpenChoreo**: < 1.0.3 (Fixed in: `1.0.3`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.3 (Fixed in: `1.1.3`)\n- **OpenChoreo**: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: `1.2.0-rc.2`)\n\n## Mitigation\n\n- Enforce Mutual TLS (mTLS) on port 8444 with a cryptographically isolated Certificate Authority.\n- Deploy Kubernetes NetworkPolicies to restrict ingress on port 8444 to authorized control-plane components only.\n- Implement continuous log auditing to scan for unauthenticated requests directed at internal /api/ endpoints.\n\n**Remediation Steps:**\n1. Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.\n2. Verify that the Helm parameter clusterGateway.internalMtls.enabled is explicitly set to true.\n3. Deploy network isolation policy to restrict adjacent network communications targeting the gateway pod.\n\n## References\n\n- [GitHub Security Advisory GHSA-rh53-xvx2-j327](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327)\n- [OpenChoreo Pull Request 4256](https://github.com/openchoreo/openchoreo/pull/4256)\n- [OpenChoreo Pull Request 4258](https://github.com/openchoreo/openchoreo/pull/4258)\n- [OpenChoreo Pull Request 4259](https://github.com/openchoreo/openchoreo/pull/4259)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73842) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T23:32:53.766269Z"} {"uuid": "ebd8eb28-34e7-4da7-bc53-bbb152a8c4a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73842", "type": "seen", "source": "https://gist.github.com/alon710/e3fcd961ce3e45afd531f9a1d48bb4cf", "content": "# CVE-2026-73842: CVE-2026-73842: Missing Authentication and Authorization on Internal Management Listener in OpenChoreo cluster-gateway\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73842\n\n## Summary\nA critical-severity missing authentication and privilege management vulnerability was identified in the OpenChoreo cluster-gateway component. The gateway exposed internal management endpoints, including arbitrary Kubernetes proxying and execution interfaces, on an unauthenticated port. An adjacent attacker within the control-plane network can bypass RBAC controls entirely and gain administrative control over all connected data planes.\n\n## TL;DR\nOpenChoreo cluster-gateway exposed administrative routes on port 8444 without requiring authentication, enabling network-adjacent attackers to execute arbitrary commands and retrieve secrets across connected Kubernetes clusters.\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Adjacent\n- **CVSS v3.1 Score**: 9.0\n- **EPSS Score**: 0.0018 (0.18%)\n- **Exploit Status**: none\n- **CISA KEV**: No\n\n## Affected Systems\n\n- OpenChoreo cluster-gateway control-plane component\n- **OpenChoreo**: < 1.0.3 (Fixed in: `1.0.3`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.3 (Fixed in: `1.1.3`)\n- **OpenChoreo**: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: `1.2.0-rc.2`)\n\n## Mitigation\n\n- Enforce Mutual TLS (mTLS) on port 8444 with a cryptographically isolated Certificate Authority.\n- Deploy Kubernetes NetworkPolicies to restrict ingress on port 8444 to authorized control-plane components only.\n- Implement continuous log auditing to scan for unauthenticated requests directed at internal /api/ endpoints.\n\n**Remediation Steps:**\n1. Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.\n2. Verify that the Helm parameter clusterGateway.internalMtls.enabled is explicitly set to true.\n3. Deploy network isolation policy to restrict adjacent network communications targeting the gateway pod.\n\n## References\n\n- [GitHub Security Advisory GHSA-rh53-xvx2-j327](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327)\n- [OpenChoreo Pull Request 4256](https://github.com/openchoreo/openchoreo/pull/4256)\n- [OpenChoreo Pull Request 4258](https://github.com/openchoreo/openchoreo/pull/4258)\n- [OpenChoreo Pull Request 4259](https://github.com/openchoreo/openchoreo/pull/4259)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73842) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T23:32:53.766269Z"} https://vulnerability.circl.lu/sighting/ebd8eb28-34e7-4da7-bc53-bbb152a8c4a6/export Fri, 04 Sep 2026 23:32:53 +0000 https://vulnerability.circl.lu/sighting/fb4c9284-1468-44ec-b220-36de13914173/export {"uuid": "fb4c9284-1468-44ec-b220-36de13914173", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73846", "type": "seen", "source": "https://gist.github.com/alon710/6e5cd16daf1e1da3bc33cf6d0ea63990", "content": "# CVE-2026-73846: CVE-2026-73846: Cache Key Canonicalization Collision in ondata ckan-mcp-server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73846\n\n## Summary\nA medium-severity cache key canonicalization collision vulnerability exists in the ckan-mcp-server prior to version 0.4.112. Unescaped delimiters in key-value parameters and server URLs allow structurally distinct requests to map to the same cryptographic hash, facilitating cache poisoning and unauthorized data exposure.\n\n## TL;DR\nUnescaped delimiters in ckan-mcp-server's caching logic allow attackers to cause cache collisions, leading to cache poisoning and unauthorized data exposure.\n\n## Technical Details\n\n- **CWE ID**: CWE-345 / CWE-436\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00137 (Percentile: 3.39%)\n- **Impact**: Cache Poisoning / Integrity Compromise\n- **Exploit Status**: None (No Public PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ondata ckan-mcp-server\n- **ckan-mcp-server**: < 0.4.112 (Fixed in: `0.4.112`)\n\n## Mitigation\n\n- Upgrade ckan-mcp-server to version 0.4.112 or higher.\n- Implement strict input validation on query parameters to reject unescaped delimiters.\n- Disable cache entirely if data consistency is critical and performance permits.\n\n**Remediation Steps:**\n1. Identify all deployments running ondata/ckan-mcp-server.\n2. Check the package version in package.json to verify if it is below 0.4.112.\n3. Update the package dependency to version 0.4.112 or higher using npm, yarn, or pnpm.\n4. Deploy the updated application and restart the MCP server to clear any legacy poisoned cache entries.\n\n## References\n\n- [GitHub Security Advisory GHSA-78x9-fhhx-v2g6](https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6)\n- [Official Fix Commit](https://github.com/ondata/ckan-mcp-server/commit/8e1522f9bbfa1f3b21550f17887f60f133e24151)\n- [Release v0.4.112](https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112)\n- [NVD - CVE-2026-73846](https://nvd.nist.gov/vuln/detail/CVE-2026-73846)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73846) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T17:31:38.235049Z"} {"uuid": "fb4c9284-1468-44ec-b220-36de13914173", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73846", "type": "seen", "source": "https://gist.github.com/alon710/6e5cd16daf1e1da3bc33cf6d0ea63990", "content": "# CVE-2026-73846: CVE-2026-73846: Cache Key Canonicalization Collision in ondata ckan-mcp-server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73846\n\n## Summary\nA medium-severity cache key canonicalization collision vulnerability exists in the ckan-mcp-server prior to version 0.4.112. Unescaped delimiters in key-value parameters and server URLs allow structurally distinct requests to map to the same cryptographic hash, facilitating cache poisoning and unauthorized data exposure.\n\n## TL;DR\nUnescaped delimiters in ckan-mcp-server's caching logic allow attackers to cause cache collisions, leading to cache poisoning and unauthorized data exposure.\n\n## Technical Details\n\n- **CWE ID**: CWE-345 / CWE-436\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5 (Medium)\n- **EPSS Score**: 0.00137 (Percentile: 3.39%)\n- **Impact**: Cache Poisoning / Integrity Compromise\n- **Exploit Status**: None (No Public PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ondata ckan-mcp-server\n- **ckan-mcp-server**: < 0.4.112 (Fixed in: `0.4.112`)\n\n## Mitigation\n\n- Upgrade ckan-mcp-server to version 0.4.112 or higher.\n- Implement strict input validation on query parameters to reject unescaped delimiters.\n- Disable cache entirely if data consistency is critical and performance permits.\n\n**Remediation Steps:**\n1. Identify all deployments running ondata/ckan-mcp-server.\n2. Check the package version in package.json to verify if it is below 0.4.112.\n3. Update the package dependency to version 0.4.112 or higher using npm, yarn, or pnpm.\n4. Deploy the updated application and restart the MCP server to clear any legacy poisoned cache entries.\n\n## References\n\n- [GitHub Security Advisory GHSA-78x9-fhhx-v2g6](https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6)\n- [Official Fix Commit](https://github.com/ondata/ckan-mcp-server/commit/8e1522f9bbfa1f3b21550f17887f60f133e24151)\n- [Release v0.4.112](https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112)\n- [NVD - CVE-2026-73846](https://nvd.nist.gov/vuln/detail/CVE-2026-73846)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73846) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T17:31:38.235049Z"} https://vulnerability.circl.lu/sighting/fb4c9284-1468-44ec-b220-36de13914173/export Thu, 03 Sep 2026 17:31:38 +0000 https://vulnerability.circl.lu/sighting/cc97d826-2261-45cc-959f-a41a335cedc4/export {"uuid": "cc97d826-2261-45cc-959f-a41a335cedc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73844", "type": "published-proof-of-concept", "source": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3", "content": "", "creation_timestamp": "2026-09-03T16:35:05.017548Z"} {"uuid": "cc97d826-2261-45cc-959f-a41a335cedc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73844", "type": "published-proof-of-concept", "source": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3", "content": "", "creation_timestamp": "2026-09-03T16:35:05.017548Z"} https://vulnerability.circl.lu/sighting/cc97d826-2261-45cc-959f-a41a335cedc4/export Thu, 03 Sep 2026 16:35:05 +0000 https://vulnerability.circl.lu/sighting/5c63bd5d-c597-4e27-9fe7-b386c402c09d/export {"uuid": "5c63bd5d-c597-4e27-9fe7-b386c402c09d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73846", "type": "published-proof-of-concept", "source": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6", "content": "", "creation_timestamp": "2026-09-03T16:35:02.793379Z"} {"uuid": "5c63bd5d-c597-4e27-9fe7-b386c402c09d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73846", "type": "published-proof-of-concept", "source": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6", "content": "", "creation_timestamp": "2026-09-03T16:35:02.793379Z"} https://vulnerability.circl.lu/sighting/5c63bd5d-c597-4e27-9fe7-b386c402c09d/export Thu, 03 Sep 2026 16:35:02 +0000 https://vulnerability.circl.lu/sighting/6536debc-ce51-4675-862c-5905a7aa42be/export {"uuid": "6536debc-ce51-4675-862c-5905a7aa42be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://gist.github.com/alon710/4cc3ecb49324472f51ec38f524b61b28", "content": "# CVE-2026-73843: CVE-2026-73843: Critical Missing Authentication and Privilege Escalation in OpenChoreo Cluster Gateway\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73843\n\n## Summary\nPrior to versions 1.0.2 and 1.1.2, OpenChoreo's cluster gateway combined public agent traffic and administrative control-plane APIs on a single TCP port (8443). Exposing this port allowed external unauthenticated actors to access sensitive proxy and execution interfaces.\n\n## TL;DR\nOpenChoreo allowed unauthenticated remote command execution and API proxying in target Kubernetes clusters due to sharing public and private ports on the same gateway multiplexer.\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-668\n- **Attack Vector**: Adjacent Network\n- **CVSS Severity**: 9.6 (Critical)\n- **EPSS Score**: 0.00291\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo Control Plane\n- OpenChoreo Cluster Gateway\n- **OpenChoreo**: < 1.0.2 (Fixed in: `1.0.2`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.2 (Fixed in: `1.1.2`)\n\n## Mitigation\n\n- Upgrade OpenChoreo to version 1.0.2 or 1.1.2\n- Apply Kubernetes NetworkPolicies to isolate internal-api port 8444\n- Audit Helm deployments and Ingress rules to verify port separation compliance\n\n**Remediation Steps:**\n1. Identify active cluster-gateway components deployed across the infrastructure.\n2. Apply the version upgrade via Helm using official patched charts.\n3. Enforce NetworkPolicies restricting inbound traffic on target port 8444.\n4. Validate the exposure status of port 8443 and verify that /api paths return a 404 status code.\n\n## References\n\n- [GitHub Security Advisory GHSA-qh9r-j7rp-4x2m](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m)\n- [Remediation Pull Request #4122](https://github.com/openchoreo/openchoreo/pull/4122)\n- [Core Remediation Commit](https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73843) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T03:32:56.155343Z"} {"uuid": "6536debc-ce51-4675-862c-5905a7aa42be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73843", "type": "seen", "source": "https://gist.github.com/alon710/4cc3ecb49324472f51ec38f524b61b28", "content": "# CVE-2026-73843: CVE-2026-73843: Critical Missing Authentication and Privilege Escalation in OpenChoreo Cluster Gateway\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73843\n\n## Summary\nPrior to versions 1.0.2 and 1.1.2, OpenChoreo's cluster gateway combined public agent traffic and administrative control-plane APIs on a single TCP port (8443). Exposing this port allowed external unauthenticated actors to access sensitive proxy and execution interfaces.\n\n## TL;DR\nOpenChoreo allowed unauthenticated remote command execution and API proxying in target Kubernetes clusters due to sharing public and private ports on the same gateway multiplexer.\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-668\n- **Attack Vector**: Adjacent Network\n- **CVSS Severity**: 9.6 (Critical)\n- **EPSS Score**: 0.00291\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo Control Plane\n- OpenChoreo Cluster Gateway\n- **OpenChoreo**: < 1.0.2 (Fixed in: `1.0.2`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.2 (Fixed in: `1.1.2`)\n\n## Mitigation\n\n- Upgrade OpenChoreo to version 1.0.2 or 1.1.2\n- Apply Kubernetes NetworkPolicies to isolate internal-api port 8444\n- Audit Helm deployments and Ingress rules to verify port separation compliance\n\n**Remediation Steps:**\n1. Identify active cluster-gateway components deployed across the infrastructure.\n2. Apply the version upgrade via Helm using official patched charts.\n3. Enforce NetworkPolicies restricting inbound traffic on target port 8444.\n4. Validate the exposure status of port 8443 and verify that /api paths return a 404 status code.\n\n## References\n\n- [GitHub Security Advisory GHSA-qh9r-j7rp-4x2m](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m)\n- [Remediation Pull Request #4122](https://github.com/openchoreo/openchoreo/pull/4122)\n- [Core Remediation Commit](https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73843) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T03:32:56.155343Z"} https://vulnerability.circl.lu/sighting/6536debc-ce51-4675-862c-5905a7aa42be/export Thu, 03 Sep 2026 03:32:56 +0000 https://vulnerability.circl.lu/sighting/217b5797-55b2-462e-9074-2773a817f3b1/export {"uuid": "217b5797-55b2-462e-9074-2773a817f3b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73841", "type": "seen", "source": "https://gist.github.com/alon710/fa4c1447c893b6cd0a1784fbaa13a97e", "content": "# CVE-2026-73841: CVE-2026-73841: Broken Object Level Authorization (BOLA) in OpenChoreo Container Exec and Wirelogs Endpoints\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73841\n\n## Summary\nAn Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) vulnerability in OpenChoreo allows authenticated users with project-level permissions to bypass tenant boundaries. By manipulating client-controlled query parameters, an attacker can execute arbitrary commands inside Kubernetes containers or view sensitive communication streams of resources belonging to other, highly privileged projects within the same namespace.\n\n## TL;DR\nOpenChoreo failed to validate if a target component belonged to the caller's authorized project when processing container command executions and wirelog requests. Attackers could specify a project they owned while targeting components in other projects, gaining unauthorized remote shell access to arbitrary pods.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639 / CWE-863\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.8 (High)\n- **EPSS Score**: 0.00353 (Percentile: 28.24%)\n- **Impact**: Command Execution / Information Disclosure\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo API Server (openchoreo-api)\n- **OpenChoreo**: < 1.1.6 (Fixed in: `1.1.6`)\n- **OpenChoreo**: >= 1.2.0-m.1, < 1.2.3 (Fixed in: `1.2.3`)\n\n## Mitigation\n\n- Upgrade OpenChoreo deployment to version 1.1.6 or 1.2.3 immediately.\n- Audit active project role-bindings to restrict permissions such as `component:exec` and `wirelogs:view` to essential personnel.\n- Deploy network policies to isolate sensitive pods from direct inter-namespace and inter-project communication.\n\n**Remediation Steps:**\n1. Identify the current deployed version of OpenChoreo in your cluster.\n2. For installations on the 1.1 release line, apply the update to version 1.1.6.\n3. For installations on the 1.2 release line, apply the update to version 1.2.3.\n4. Verify deployment status by inspecting the `openchoreo-api` image tag and confirming it matches the patched releases.\n5. Monitor application logs for any unauthorized request denials containing the message: 'requested project does not own the target component; denying exec'.\n\n## References\n\n- [GitHub Security Advisory GHSA-52gf-6rpq-fgmx](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx)\n- [CVE-2026-73841 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-73841)\n- [OpenChoreo Pull Request 4251](https://github.com/openchoreo/openchoreo/pull/4251)\n- [OpenChoreo Pull Request 4516](https://github.com/openchoreo/openchoreo/pull/4516)\n- [OpenChoreo Pull Request 4538](https://github.com/openchoreo/openchoreo/pull/4538)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73841) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T02:33:26.794457Z"} {"uuid": "217b5797-55b2-462e-9074-2773a817f3b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73841", "type": "seen", "source": "https://gist.github.com/alon710/fa4c1447c893b6cd0a1784fbaa13a97e", "content": "# CVE-2026-73841: CVE-2026-73841: Broken Object Level Authorization (BOLA) in OpenChoreo Container Exec and Wirelogs Endpoints\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73841\n\n## Summary\nAn Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) vulnerability in OpenChoreo allows authenticated users with project-level permissions to bypass tenant boundaries. By manipulating client-controlled query parameters, an attacker can execute arbitrary commands inside Kubernetes containers or view sensitive communication streams of resources belonging to other, highly privileged projects within the same namespace.\n\n## TL;DR\nOpenChoreo failed to validate if a target component belonged to the caller's authorized project when processing container command executions and wirelog requests. Attackers could specify a project they owned while targeting components in other projects, gaining unauthorized remote shell access to arbitrary pods.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639 / CWE-863\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.8 (High)\n- **EPSS Score**: 0.00353 (Percentile: 28.24%)\n- **Impact**: Command Execution / Information Disclosure\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo API Server (openchoreo-api)\n- **OpenChoreo**: < 1.1.6 (Fixed in: `1.1.6`)\n- **OpenChoreo**: >= 1.2.0-m.1, < 1.2.3 (Fixed in: `1.2.3`)\n\n## Mitigation\n\n- Upgrade OpenChoreo deployment to version 1.1.6 or 1.2.3 immediately.\n- Audit active project role-bindings to restrict permissions such as `component:exec` and `wirelogs:view` to essential personnel.\n- Deploy network policies to isolate sensitive pods from direct inter-namespace and inter-project communication.\n\n**Remediation Steps:**\n1. Identify the current deployed version of OpenChoreo in your cluster.\n2. For installations on the 1.1 release line, apply the update to version 1.1.6.\n3. For installations on the 1.2 release line, apply the update to version 1.2.3.\n4. Verify deployment status by inspecting the `openchoreo-api` image tag and confirming it matches the patched releases.\n5. Monitor application logs for any unauthorized request denials containing the message: 'requested project does not own the target component; denying exec'.\n\n## References\n\n- [GitHub Security Advisory GHSA-52gf-6rpq-fgmx](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx)\n- [CVE-2026-73841 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-73841)\n- [OpenChoreo Pull Request 4251](https://github.com/openchoreo/openchoreo/pull/4251)\n- [OpenChoreo Pull Request 4516](https://github.com/openchoreo/openchoreo/pull/4516)\n- [OpenChoreo Pull Request 4538](https://github.com/openchoreo/openchoreo/pull/4538)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73841) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T02:33:26.794457Z"} https://vulnerability.circl.lu/sighting/217b5797-55b2-462e-9074-2773a817f3b1/export Thu, 03 Sep 2026 02:33:26 +0000 https://vulnerability.circl.lu/sighting/3b033f7a-c2be-4021-b6cd-988f9b3599b8/export {"uuid": "3b033f7a-c2be-4021-b6cd-988f9b3599b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73840", "type": "seen", "source": "https://gist.github.com/alon710/334e1eb2f1175b3ba4114070f1401a17", "content": "# CVE-2026-73840: CVE-2026-73840: Unauthenticated Webhook Signature Bypass and Git-Provider Confusion in OpenChoreo\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73840\n\n## Summary\nAn authentication bypass and logical confusion vulnerability exists in the OpenChoreo Kubernetes developer platform webhook ingestion system. By exploiting a combination of git-provider spoofing, a missing signature validation requirement on Bitbucket webhooks, and a lack of source-host mapping checks, unauthenticated network attackers can trigger unauthorized builds on arbitrary repositories.\n\n## TL;DR\nAn unauthenticated remote attacker can trigger arbitrary builds on target Kubernetes repositories by spoofing Bitbucket webhook headers and bypassing signature validation checks due to logical flaws in the OpenChoreo handler.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: 0.00237\n- **Impact Rating**: Availability (Low)\n- **Exploit Status**: PoC in Tests\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo Kubernetes platform deployments utilizing auto-build features\n- **OpenChoreo**: < 1.0.3 (Fixed in: `1.0.3`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.3 (Fixed in: `1.1.3`)\n- **OpenChoreo**: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: `1.2.0-rc.2`)\n\n## Mitigation\n\n- Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.\n- Enforce HMAC-SHA256 signatures for all webhook pipelines including Bitbucket integrations.\n- Restrict ingress path access to trusted IP ranges of external Git service providers.\n\n**Remediation Steps:**\n1. Identify all OpenChoreo namespace installations within the Kubernetes cluster.\n2. Update deployment manifests to pull openchoreo images at version 1.0.3, 1.1.3, or higher.\n3. Generate strong random secrets for Bitbucket webhooks.\n4. Update the 'git-webhook-secrets' Kubernetes Secret to populate the 'bitbucket-secret' field.\n5. Configure the corresponding repositories on Bitbucket with the same secret and enable hook signatures.\n6. Verify pipeline triggers function properly and reject unsigned test payloads.\n\n## References\n\n- [NVD - CVE-2026-73840](https://nvd.nist.gov/vuln/detail/CVE-2026-73840)\n- [GitHub Security Advisory GHSA-c5f6-2rm9-2w8g](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73840) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T01:32:19.741152Z"} {"uuid": "3b033f7a-c2be-4021-b6cd-988f9b3599b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73840", "type": "seen", "source": "https://gist.github.com/alon710/334e1eb2f1175b3ba4114070f1401a17", "content": "# CVE-2026-73840: CVE-2026-73840: Unauthenticated Webhook Signature Bypass and Git-Provider Confusion in OpenChoreo\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73840\n\n## Summary\nAn authentication bypass and logical confusion vulnerability exists in the OpenChoreo Kubernetes developer platform webhook ingestion system. By exploiting a combination of git-provider spoofing, a missing signature validation requirement on Bitbucket webhooks, and a lack of source-host mapping checks, unauthenticated network attackers can trigger unauthorized builds on arbitrary repositories.\n\n## TL;DR\nAn unauthenticated remote attacker can trigger arbitrary builds on target Kubernetes repositories by spoofing Bitbucket webhook headers and bypassing signature validation checks due to logical flaws in the OpenChoreo handler.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: 0.00237\n- **Impact Rating**: Availability (Low)\n- **Exploit Status**: PoC in Tests\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo Kubernetes platform deployments utilizing auto-build features\n- **OpenChoreo**: < 1.0.3 (Fixed in: `1.0.3`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.3 (Fixed in: `1.1.3`)\n- **OpenChoreo**: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: `1.2.0-rc.2`)\n\n## Mitigation\n\n- Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.\n- Enforce HMAC-SHA256 signatures for all webhook pipelines including Bitbucket integrations.\n- Restrict ingress path access to trusted IP ranges of external Git service providers.\n\n**Remediation Steps:**\n1. Identify all OpenChoreo namespace installations within the Kubernetes cluster.\n2. Update deployment manifests to pull openchoreo images at version 1.0.3, 1.1.3, or higher.\n3. Generate strong random secrets for Bitbucket webhooks.\n4. Update the 'git-webhook-secrets' Kubernetes Secret to populate the 'bitbucket-secret' field.\n5. Configure the corresponding repositories on Bitbucket with the same secret and enable hook signatures.\n6. Verify pipeline triggers function properly and reject unsigned test payloads.\n\n## References\n\n- [NVD - CVE-2026-73840](https://nvd.nist.gov/vuln/detail/CVE-2026-73840)\n- [GitHub Security Advisory GHSA-c5f6-2rm9-2w8g](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73840) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T01:32:19.741152Z"} https://vulnerability.circl.lu/sighting/3b033f7a-c2be-4021-b6cd-988f9b3599b8/export Thu, 03 Sep 2026 01:32:19 +0000 https://vulnerability.circl.lu/sighting/45070a25-52f8-49d1-9fa1-8e67dabd6029/export {"uuid": "45070a25-52f8-49d1-9fa1-8e67dabd6029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73845", "type": "published-proof-of-concept", "source": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-83x6-42hr-jc76", "content": "", "creation_timestamp": "2026-09-02T16:35:22.775654Z"} {"uuid": "45070a25-52f8-49d1-9fa1-8e67dabd6029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73845", "type": "published-proof-of-concept", "source": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-83x6-42hr-jc76", "content": "", "creation_timestamp": "2026-09-02T16:35:22.775654Z"} https://vulnerability.circl.lu/sighting/45070a25-52f8-49d1-9fa1-8e67dabd6029/export Wed, 02 Sep 2026 16:35:22 +0000