OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints (CVE-2026-73841)

The OpenChoreo API server's exec and wirelogs endpoints authorize requests against the project specified by the caller rather than the component's real owning project. This flaw allows an authenticated tenant with a project-scoped component:exec or wirelogs:view grant on one project to execute arbitrary commands, including interactive shells, and read wirelogs on components owned by other projects in the same namespace. The vulnerability exposes environment variables, mounted Secrets, and enables workload tampering and lateral movement within the namespace. The issue is fixed in versions 1.2.3 and 1.1.6 by aligning authorization checks to the component's actual owning project.

An authenticated user with limited project-scoped exec or wirelogs view permissions can escalate privileges within the namespace by executing arbitrary commands and accessing sensitive logs on components owned by other projects. This leads to exposure of environment variables and Secrets such as database credentials and API keys, potential tampering with workloads, and further pivoting opportunities. The vulnerability's blast radius includes all components within the same namespace but does not cross namespace boundaries.

A patch is available and should be applied by upgrading to OpenChoreo versions 1.1.6 or 1.2.3 or later. If immediate upgrade is not possible, restrict component:exec and wirelogs:view grants to trusted operators only, as any holder of these grants on any project can access all components in the namespace. For stronger isolation, separate sensitive components into distinct namespaces since the vulnerability does not cross namespace boundaries.