DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-73667: CVE-2026-73667: Remote Code Execution via OS Command Injection in OpenChoreo Workflow Plane

#security #cve #cybersecurity

CVE-2026-73667: Remote Code Execution via OS Command Injection in OpenChoreo Workflow Plane

Vulnerability ID: CVE-2026-73667
CVSS Score: 8.8
Published: 2026-09-02

An authenticated remote code execution vulnerability exists in the OpenChoreo developer platform's Workflow Plane templates. The flaw occurs due to server-side string interpolation of workflow parameters into inline shell scripts and insecure shell parameter expansion. This allows low-privileged attackers to execute arbitrary shell commands inside privileged containers, leading to potential host privilege escalation.

TL;DR

Authenticated OS command injection in OpenChoreo workflow templates allows execution of arbitrary commands with container root privileges.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-78
  • Attack Vector: Network (AV:N)
  • CVSS Base Score: 8.8
  • Privileges Required: Low (PR:L)
  • Exploit Status: Proof of Concept (PoC)
  • KEV Status: Not Listed

Affected Systems

  • OpenChoreo Workflow Plane
  • OpenChoreo Argo Workflows Integration
  • OpenChoreo: < 1.0.4 (Fixed in: 1.0.4)
  • OpenChoreo: >= 1.1.0, < 1.1.4 (Fixed in: 1.1.4)
  • OpenChoreo: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: 1.2.0-rc.2)

Code Analysis

Commit: 017c3c6

Initial template injection remediation by decoupling parameter evaluation via container env

Commit: b274127

Refactoring of test and sample suites to support environment variable parameters

Commit: fb2b659

Advanced parameter safety utilizing base64 encoding and enforcing host-user namespace constraints

Mitigation Strategies

  • Map workflow parameters to container environment variables instead of using raw string interpolation in inline shell scripts.
  • Utilize double-quoted variable expansion inside shell scripts to prevent token splitting and injection.
  • Enforce host-user namespace isolation ('hostUsers: false') for privileged workflow pods.
  • Employ base64-encoding to safely pass complex parameter vectors to inner loop parsing structures.

Remediation Steps:

  1. Upgrade OpenChoreo deployments to version 1.0.4, 1.1.4, 1.2.0-rc.2, or higher.
  2. Audit custom workflow templates in use to ensure no legacy server-side interpolation placeholders exist inside inline command scripts.
  3. Enable Kubernetes Pod Security Standards or Gatekeeper policies to enforce 'hostUsers: false' on privileged workloads.

References

Read the full report for CVE-2026-73667 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)