CVE-2026-73843: Critical Missing Authentication and Privilege Escalation in OpenChoreo Cluster Gateway
Vulnerability ID: CVE-2026-73843
CVSS Score: 9.6
Published: 2026-09-02
Prior to versions 1.0.2 and 1.1.2, OpenChoreo's cluster gateway combined public agent traffic and administrative control-plane APIs on a single TCP port (8443). Exposing this port allowed external unauthenticated actors to access sensitive proxy and execution interfaces.
TL;DR
OpenChoreo allowed unauthenticated remote command execution and API proxying in target Kubernetes clusters due to sharing public and private ports on the same gateway multiplexer.
Technical Details
- CWE ID: CWE-306, CWE-668
- Attack Vector: Adjacent Network
- CVSS Severity: 9.6 (Critical)
- EPSS Score: 0.00291
- Exploit Status: None
- CISA KEV Status: Not Listed
Affected Systems
- OpenChoreo Control Plane
- OpenChoreo Cluster Gateway
-
OpenChoreo: < 1.0.2 (Fixed in:
1.0.2) -
OpenChoreo: >= 1.1.0, < 1.1.2 (Fixed in:
1.1.2)
Code Analysis
Commit: b42eeb0
Separation of public and internal gateway servers
Diff content showing separation of publicMux and internalMux
Mitigation Strategies
- Upgrade OpenChoreo to version 1.0.2 or 1.1.2
- Apply Kubernetes NetworkPolicies to isolate internal-api port 8444
- Audit Helm deployments and Ingress rules to verify port separation compliance
Remediation Steps:
- Identify active cluster-gateway components deployed across the infrastructure.
- Apply the version upgrade via Helm using official patched charts.
- Enforce NetworkPolicies restricting inbound traffic on target port 8444.
- Validate the exposure status of port 8443 and verify that /api paths return a 404 status code.
References
Read the full report for CVE-2026-73843 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)