cve.bz

CVE-2026-73667

8.8 highEPSS 0.9%

High (8.8). EPSS 0.9% chance of exploitation in the next 30 days. Fixed in github.com/openchoreo/openchoreo 1.0.4, 1.1.4, 1.2.0-rc.2.

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE
CWE-78
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2mw5-23gm-pccqGogithub.com/openchoreo/openchoreo<1.0.41.0.4
GHSA-2mw5-23gm-pccqGogithub.com/openchoreo/openchoreo>=1.1.0 <1.1.41.1.4
GHSA-2mw5-23gm-pccqGogithub.com/openchoreo/openchoreo>=1.2.0-rc.1 <1.2.0-rc.21.2.0-rc.2
GO-2026-6357Gogithub.com/openchoreo/openchoreo<1.0.4
>=1.1.0 <1.1.4
>=1.2.0-rc.1 <1.2.0-rc.2		1.0.4, 1.1.4, 1.2.0-rc.2

References

Check your stackJSON