{"cve":"CVE-2026-73841","nvd":{"published":"2026-08-13T22:17:28.900","modified":"2026-09-08T20:56:50.520","status":"Deferred","description":"OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-639","CWE-863"],"references":["https://github.com/openchoreo/openchoreo/commit/4d372eaf1f07525663dcca5257062f4b051b9820","https://github.com/openchoreo/openchoreo/commit/9d77b64f747eba89247c47ebfeffec591c4cd2d8","https://github.com/openchoreo/openchoreo/commit/c9390e4fcb9953f43b07cb48197576182301593d","https://github.com/openchoreo/openchoreo/pull/4251","https://github.com/openchoreo/openchoreo/pull/4516"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-73841","score":0.00809,"percentile":0.56912,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-52gf-6rpq-fgmx","url":"https://osv.dev/vulnerability/GHSA-52gf-6rpq-fgmx","summary":"OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints","modified":"2026-09-10T15:25:27.982893607Z","packages":[{"ecosystem":"Go","name":"github.com/openchoreo/openchoreo","purl":"pkg:golang/github.com/openchoreo/openchoreo","ranges":[">=1.2.0-m.1 <1.2.3"],"fixed":["1.2.3"]},{"ecosystem":"Go","name":"github.com/openchoreo/openchoreo","purl":"pkg:golang/github.com/openchoreo/openchoreo","ranges":["<1.1.6"],"fixed":["1.1.6"]}]},{"id":"GO-2026-6358","url":"https://osv.dev/vulnerability/GO-2026-6358","summary":"OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo","modified":"2026-09-10T15:15:12.921836965Z","packages":[{"ecosystem":"Go","name":"github.com/openchoreo/openchoreo","purl":"pkg:golang/github.com/openchoreo/openchoreo","ranges":["<1.1.6",">=1.2.0-m.1 <1.2.3"],"fixed":["1.1.6","1.2.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}