CVE-2026-73841 - OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
Brief
CVE ID : CVE-2026-73841
Published : Aug. 13, 2026, 10:17 p. m.
- 48 minutes ago
Description : OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.
- 0-rc. 1 until 1.
- 0, internal/openchoreo-api/api/handlers/exec. go and internal/openchoreo-api/api/handlers/wirelogs. go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp. Spec. Owner.
ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.
- 0.
Severity: 8.8
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...