Skip to content
OpenAdvisories
High · 8.8 CVE-2026-73841 EUVD-2026-58507GHSA-52gf-6rpq-fgmxGO-2026-6358

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Published Aug 13, 2026 · Updated Sep 2, 2026 · Assigned by GitHub_M

Description

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.1.6 and 1.2.3.

Affected products

VendorProductAffectedFixed
openchoreo openchoreo >= 1.2.0-m.1, < 1.2.3, < 1.1.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260916T180043-160000.1.1 SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1
SLES 16.0 govulncheck-vulndb 0.0.20260916T180043-160000.1.1 SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260916T180043-160000.1.1 openSUSE-SU-2026:21897-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/openchoreo/openchoreo >= 1.2.0-m.1, < 1.2.3 1.2.3 GHSA-52gf-6rpq-fgmx
Go github.com/openchoreo/openchoreo < 1.1.6 1.1.6 GHSA-52gf-6rpq-fgmx
Go github.com/openchoreo/openchoreo < 1.1.6 · >= 1.2.0-m.1, < 1.2.3 1.1.6, 1.2.3 GO-2026-6358

Advisories 3

References