OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs (CVE-2026-73843)

The OpenChoreo control-plane cluster-gateway served management APIs on the same network listener as data-plane agent connections, which is externally accessible in multi-cluster setups. These management APIs lacked authentication, allowing any party able to reach the listener to invoke privileged data-plane operations without authorization. This includes proxying the Kubernetes API and executing commands inside workload pods, resulting in potential full compromise of workloads. The vulnerability affects versions prior to 1.0.2 and versions from 1.1.0 up to but not including 1.1.2. The issue is fixed in versions 1.0.2, 1.1.2, and 1.2.0 by moving management APIs to an internal listener not published externally.

An attacker with network access to the externally published cluster-gateway endpoint can perform unauthorized privileged operations on the data plane, including proxying the Kubernetes API and executing commands inside workload pods. This can lead to full compromise of workloads, including data disclosure, tampering, and denial of service. The vulnerability specifically affects multi-cluster or remote data-plane topologies where the cluster-gateway is exposed outside the cluster.

A fix is available in OpenChoreo versions 1.0.2, 1.1.2, and 1.2.0. Upgrading to one of these versions is the recommended remediation and is non-disruptive, requiring only a standard chart upgrade without changes to data-plane agents or configuration. If immediate upgrade is not feasible, restrict network access to the external cluster-gateway endpoint to known data-plane source addresses using firewall or gateway-level allowlisting.