Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-14 | 1 | General1 |
| 2026-09-05 | 1 | Disclosure1 |
| 2026-09-06 | 1 | General1 |
ثغرة ⚠️ SECURITY ALERT ──────────────────── 🚨 CVE-2026-73842 🔴 الخطورة حرجة جداً CRITICAL | 9.8/10 🟥🟥🟥🟥🟥 ✅ حالة الاستغلال غير مستغلة - CISA 📈 احتمالية الاستغلال 0.2% - EPSS 📦 المنتج https://github.com/openchoreo/openchoreo يتبع.....
Post summary
The post notes a high‑severity CVE with no known exploitation, PoC, or fix information.
🔴 OpenChoreo cluster-gateway, Missing Authentication & Authorization, #CVE-2026-73842 (Critical) -DC-Sep2026-2215 https://dailycve.com/openchoreo-cluster-gateway-missing-authentication-authorization-cve-2026-73842-critical-dc-sep2026-2215/
Post summary
The post announces a critical CVE (2026-73842) for OpenChoreo cluster-gateway, highlighting a missing authentication and authorization flaw.
CVE-2026-73842 OpenChoreo Kubernetes Secrets Exposure and Command Execution via Internal API https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73842
Post summary
The entry cites CVE‑2026‑73842 with a brief title and a link to a vulnerability details page, offering no additional technical, exploit, or mitigation information.