---
id: CVE-2026-73667
title: 'OpenChoreo is a complete, open-source developer platform for Kubernetes'
summary: >-
  OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior
  to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under
  samples/getting-started/workflow-templates/ interpolated developer-controlled
  workf…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: openchoreo
product: github.com/openchoreo/openchoreo
affected:
  - github.com/openchoreo/openchoreo < 1.0.4
  - 'github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.4'
  - 'github.com/openchoreo/openchoreo >= 1.2.0-rc.1, < 1.2.0-rc.2'
patched:
  - github.com/openchoreo/openchoreo 1.0.4
  - github.com/openchoreo/openchoreo 1.1.4
  - github.com/openchoreo/openchoreo 1.2.0-rc.2
published: '2026-08-13'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:56:50.520'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73667'
references:
  - url: >-
      https://github.com/openchoreo/openchoreo/commit/017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9
    label: security-advisories@github.com
  - url: >-
      https://github.com/openchoreo/openchoreo/commit/65c081ff74618714cb0c82b5d0e0fad2c2cbc46b
    label: security-advisories@github.com
  - url: >-
      https://github.com/openchoreo/openchoreo/commit/b274127a4342e5433c5035384cef57478b5b65ed
    label: security-advisories@github.com
  - url: >-
      https://github.com/openchoreo/openchoreo/commit/fb2b659b9884eb45fa4f02b9cc7e89718a0276b7
    label: security-advisories@github.com
  - url: 'https://github.com/openchoreo/openchoreo/pull/4193'
    label: security-advisories@github.com
  - url: 'https://github.com/openchoreo/openchoreo/pull/4243'
    label: security-advisories@github.com
  - url: 'https://github.com/openchoreo/openchoreo/pull/4277'
    label: security-advisories@github.com
  - url: 'https://github.com/openchoreo/openchoreo/pull/4297'
    label: security-advisories@github.com
  - url: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.0.4'
    label: security-advisories@github.com
  - url: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.1.4'
    label: security-advisories@github.com
  - url: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/openchoreo/openchoreo/security/advisories/GHSA-2mw5-23gm-pccq
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73667'
  - url: 'https://github.com/advisories/GHSA-2mw5-23gm-pccq'
  - url: 'https://github.com/openchoreo/openchoreo'
tags:
  - nvd
  - ghsa
  - go
  - osv
epss: 0.00615
epssPercentile: 0.48141
aliases:
  - GHSA-2mw5-23gm-pccq
  - GO-2026-6357
ecosystem: go
ingestedAt: '2026-09-02T23:52:22.684Z'
---

## Overview

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-73667)

Affected packages:

- `github.com/openchoreo/openchoreo < 1.0.4`
- `github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.4`
- `github.com/openchoreo/openchoreo >= 1.2.0-rc.1, < 1.2.0-rc.2`

Patched in:

- `github.com/openchoreo/openchoreo 1.0.4`
- `github.com/openchoreo/openchoreo 1.1.4`
- `github.com/openchoreo/openchoreo 1.2.0-rc.2`

Source: https://github.com/advisories/GHSA-2mw5-23gm-pccq