{"id":"CVE-2026-73841","title":"OpenChoreo is a complete, open-source developer platform for Kubernetes","summary":"OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:vi…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-639","CWE-863"],"vendor":"openchoreo","product":"github.com/openchoreo/openchoreo","affected":["github.com/openchoreo/openchoreo >= 1.2.0-m.1, < 1.2.3","github.com/openchoreo/openchoreo < 1.1.6"],"patched":["github.com/openchoreo/openchoreo 1.2.3","github.com/openchoreo/openchoreo 1.1.6"],"published":"2026-08-13","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:56:50.520","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73841","references":[{"url":"https://github.com/openchoreo/openchoreo/commit/4d372eaf1f07525663dcca5257062f4b051b9820","label":"security-advisories@github.com"},{"url":"https://github.com/openchoreo/openchoreo/commit/9d77b64f747eba89247c47ebfeffec591c4cd2d8","label":"security-advisories@github.com"},{"url":"https://github.com/openchoreo/openchoreo/commit/c9390e4fcb9953f43b07cb48197576182301593d","label":"security-advisories@github.com"},{"url":"https://github.com/openchoreo/openchoreo/pull/4251","label":"security-advisories@github.com"},{"url":"https://github.com/openchoreo/openchoreo/pull/4516","label":"security-advisories@github.com"},{"url":"https://github.com/openchoreo/openchoreo/pull/4538","label":"security-advisories@github.com"},{"url":"https://github.com/openchoreo/openchoreo/releases/tag/v1.1.6","label":"security-advisories@github.com"},{"url":"https://github.com/openchoreo/openchoreo/releases/tag/v1.2.3","label":"security-advisories@github.com"},{"url":"https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73841"},{"url":"https://github.com/advisories/GHSA-52gf-6rpq-fgmx"},{"url":"https://github.com/openchoreo/openchoreo"}],"tags":["nvd","ghsa","go","osv"],"epss":0.00549,"epssPercentile":0.44823,"aliases":["GHSA-52gf-6rpq-fgmx","GO-2026-6358"],"ecosystem":"go","ingestedAt":"2026-09-02T23:52:22.809Z","slug":"CVE-2026-73841","body":"## Overview\n\nOpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73841)\n\nAffected packages:\n\n- `github.com/openchoreo/openchoreo >= 1.2.0-m.1, < 1.2.3`\n- `github.com/openchoreo/openchoreo < 1.1.6`\n\nPatched in:\n\n- `github.com/openchoreo/openchoreo 1.2.3`\n- `github.com/openchoreo/openchoreo 1.1.6`\n\nSource: https://github.com/advisories/GHSA-52gf-6rpq-fgmx","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}