DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-73842: CVE-2026-73842: Missing Authentication and Authorization on Internal Management Listener in OpenChoreo cluster-gateway

#security #cve #cybersecurity

CVE-2026-73842: Missing Authentication and Authorization on Internal Management Listener in OpenChoreo cluster-gateway

Vulnerability ID: CVE-2026-73842
CVSS Score: 9.0
Published: 2026-09-04

A critical-severity missing authentication and privilege management vulnerability was identified in the OpenChoreo cluster-gateway component. The gateway exposed internal management endpoints, including arbitrary Kubernetes proxying and execution interfaces, on an unauthenticated port. An adjacent attacker within the control-plane network can bypass RBAC controls entirely and gain administrative control over all connected data planes.

TL;DR

OpenChoreo cluster-gateway exposed administrative routes on port 8444 without requiring authentication, enabling network-adjacent attackers to execute arbitrary commands and retrieve secrets across connected Kubernetes clusters.

Technical Details

  • CWE ID: CWE-306
  • Attack Vector: Adjacent
  • CVSS v3.1 Score: 9.0
  • EPSS Score: 0.0018 (0.18%)
  • Exploit Status: none
  • CISA KEV: No

Affected Systems

  • OpenChoreo cluster-gateway control-plane component
  • OpenChoreo: < 1.0.3 (Fixed in: 1.0.3)
  • OpenChoreo: >= 1.1.0, < 1.1.3 (Fixed in: 1.1.3)
  • OpenChoreo: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: 1.2.0-rc.2)

Code Analysis

Commit: 93e6f10

Implement mutual TLS (mTLS) validation logic within the cluster-gateway server routing components.

Commit: e3da3c6

Configure Helm templates and cert-manager client specifications to handle dedicated internal Certificate Authorities.

Commit: 50fcae3

Add command-line flag bindings and configuration options to enforce internal mTLS operations.

Mitigation Strategies

  • Enforce Mutual TLS (mTLS) on port 8444 with a cryptographically isolated Certificate Authority.
  • Deploy Kubernetes NetworkPolicies to restrict ingress on port 8444 to authorized control-plane components only.
  • Implement continuous log auditing to scan for unauthenticated requests directed at internal /api/ endpoints.

Remediation Steps:

  1. Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.
  2. Verify that the Helm parameter clusterGateway.internalMtls.enabled is explicitly set to true.
  3. Deploy network isolation policy to restrict adjacent network communications targeting the gateway pod.

References

Read the full report for CVE-2026-73842 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)