Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-14 | 1 | Disclosure1 |
| 2026-09-03 | 1 | General1 |
🔴 OpenChoreo, #OS Command Injection, #CVE-2026-73667 (High) -DC-Sep2026-2124 https://dailycve.com/openchoreo-os-command-injection-cve-2026-73667-high-dc-sep2026-2124/
Post summary
Announcement of a new high‑severity OS Command Injection vulnerability (CVE-2026-73667) in OpenChoreo, with basic technical details but no PoC, exploit code, patch information, or evidence of active exploitation.
CVE-2026-73667 Arbitrary Command Execution in OpenChoreo Workflow Plane Templates https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73667
Post summary
CVE-2026-73667 describes an arbitrary command execution flaw in OpenChoreo Workflow Plane Templates; details are linked but no PoC, exploit, or mitigation is provided.