{"items":[{"id":"NVI-00013952","kind":"vulnerability","title":"OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qh9r-j7rp-4x2m","CVE-2026-73843"],"plain_summary":"GitHub lists this reviewed advisory for github.com/openchoreo/openchoreo, github.com/openchoreo/openchoreo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-259f1f392e057cceee45175f7e0f6fa0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-08T20:31:51.000Z","value":"9.6 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-259f1f392e057cceee45175f7e0f6fa0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-259f1f392e057cceee45175f7e0f6fa0","url":"https://github.com/advisories/GHSA-qh9r-j7rp-4x2m","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qh9r-j7rp-4x2m","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:31.767Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-259f1f392e057cceee45175f7e0f6fa0"],"technology":"github.com/openchoreo/openchoreo","known_exclusions":[],"conditions_summary":"### Summary\nThe OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the calling client. A party able to reach the listener could therefore invoke privileged data-plane operations without authenticating and without passing through the OpenChoreo API server's authorization.\n\n### Impact\nAn attacker who can reach the externally published cluster-gateway endpoint can perform data-plane operations normally restricted to the OpenChoreo API server and gated by its authorization — including proxying the data plane's Kubernetes API and executing commands inside workload pods. This can result in full compromise of workloads on the affected data plane (disclosure, tampering, and denial of service).\n\nThe exposure applies to the multi-cluster / remote data-plane topology, where the cluster-gateway is published outside the cluster so remote data-plane agents can connect. That same externally reachable listener also served the caller-facing management APIs, which did not a","public_affected_ranges":["< 1.0.2"]},{"certainty":"source_listed","source_ids":["sr-259f1f392e057cceee45175f7e0f6fa0"],"technology":"github.com/openchoreo/openchoreo","known_exclusions":[],"conditions_summary":"### Summary\nThe OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the calling client. A party able to reach the listener could therefore invoke privileged data-plane operations without authenticating and without passing through the OpenChoreo API server's authorization.\n\n### Impact\nAn attacker who can reach the externally published cluster-gateway endpoint can perform data-plane operations normally restricted to the OpenChoreo API server and gated by its authorization — including proxying the data plane's Kubernetes API and executing commands inside workload pods. This can result in full compromise of workloads on the affected data plane (disclosure, tampering, and denial of service).\n\nThe exposure applies to the multi-cluster / remote data-plane topology, where the cluster-gateway is published outside the cluster so remote data-plane agents can connect. That same externally reachable listener also served the caller-facing management APIs, which did not a","public_affected_ranges":[">= 1.1.0, < 1.1.2"]}],"null_published_at":"2026-11-02T10:00:37.191Z","source_updated_at":"2026-09-08T20:31:51.000Z","source_disclosed_at":"2026-09-02T23:43:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:20:31.767Z"}],"next_cursor":null,"snapshot_revision":"42594"}