Threats tagged 'ghsa-rh53-xvx2-j327'

OpenChoreo's cluster-gateway internal proxy lacks caller authentication and improperly allows mutating requests, exposing internal management APIs that tunnel to connected Kubernetes data planes. This flaw permits unauthenticated parties with network access to read Secrets in tenant namespaces, modify workloads, and execute commands inside pods. The vulnerability affects versions prior to 1.0.3 and versions from 1.1.0 up to but not including 1.1.3. It is fixed in versions 1.0.3, 1.1.3, and 1.2.0. The severity is critical due to the potential for full cluster compromise if the internal listener is reachable by untrusted workloads without network restrictions.