DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-73841: CVE-2026-73841: Broken Object Level Authorization (BOLA) in OpenChoreo Container Exec and Wirelogs Endpoints

#security #cve #cybersecurity

CVE-2026-73841: Broken Object Level Authorization (BOLA) in OpenChoreo Container Exec and Wirelogs Endpoints

Vulnerability ID: CVE-2026-73841
CVSS Score: 8.8
Published: 2026-09-02

An Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) vulnerability in OpenChoreo allows authenticated users with project-level permissions to bypass tenant boundaries. By manipulating client-controlled query parameters, an attacker can execute arbitrary commands inside Kubernetes containers or view sensitive communication streams of resources belonging to other, highly privileged projects within the same namespace.

TL;DR

OpenChoreo failed to validate if a target component belonged to the caller's authorized project when processing container command executions and wirelog requests. Attackers could specify a project they owned while targeting components in other projects, gaining unauthorized remote shell access to arbitrary pods.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-639 / CWE-863
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.8 (High)
  • EPSS Score: 0.00353 (Percentile: 28.24%)
  • Impact: Command Execution / Information Disclosure
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • OpenChoreo API Server (openchoreo-api)
  • OpenChoreo: < 1.1.6 (Fixed in: 1.1.6)
  • OpenChoreo: >= 1.2.0-m.1, < 1.2.3 (Fixed in: 1.2.3)

Code Analysis

Commit: 4d372ea

Fix BOLA/IDOR vulnerability in exec and wirelogs handler by checking component project ownership.

Commit: 9d77b64

Backport of BOLA fix to release branch v1.1.

Commit: c9390e4

Backport of BOLA fix to release branch v1.2.

Mitigation Strategies

  • Upgrade OpenChoreo deployment to version 1.1.6 or 1.2.3 immediately.
  • Audit active project role-bindings to restrict permissions such as component:exec and wirelogs:view to essential personnel.
  • Deploy network policies to isolate sensitive pods from direct inter-namespace and inter-project communication.

Remediation Steps:

  1. Identify the current deployed version of OpenChoreo in your cluster.
  2. For installations on the 1.1 release line, apply the update to version 1.1.6.
  3. For installations on the 1.2 release line, apply the update to version 1.2.3.
  4. Verify deployment status by inspecting the openchoreo-api image tag and confirming it matches the patched releases.
  5. Monitor application logs for any unauthorized request denials containing the message: 'requested project does not own the target component; denying exec'.

References

Read the full report for CVE-2026-73841 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)