EUVD-2026-58507Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network API reachable with low-privilege auth; trivial query-param substitution (AC:L); exec and log access justify full C/H/I/H/A:H; scope unchanged as exploitation stays within the namespace.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0.
AnalysisAI
Authorization bypass in OpenChoreo's Kubernetes developer platform allows any authenticated user with a project-scoped grant to execute commands in and exfiltrate wirelogs from components belonging to entirely different projects within the same namespace. The root cause is that the component:exec and wirelogs:view API handlers in exec.go and wirelogs.go evaluate authorization using the attacker-controlled project query parameter rather than the authoritative comp.Spec.Owner.ProjectName field - a textbook CWE-639 insecure direct object reference. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated OpenChoreo user holding at least a project-scoped grant (any project within the same Kubernetes namespace as the target) - CVSS PR:L confirms low-privilege authenticated access is required, not unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8, reflecting a network-reachable, low-complexity flaw requiring only low-privilege authentication (any project-scoped user). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has legitimately obtained a project-scoped grant for their own project (`project-attacker`) within a shared OpenChoreo namespace issues an API request to the `component:exec` or `wirelogs:view` endpoint, substituting `project-victim` as the query parameter value. Because the authorization check trusts this caller-supplied value, the API grants access to a component owned by `project-victim`. … |
| Remediation | Upgrade to OpenChoreo 1.2.0, which contains the confirmed fix replacing the caller-supplied project query parameter with the authoritative server-side `comp.Spec.Owner.ProjectName` field for authorization in both `exec.go` and `wirelogs.go`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, review and correlate authentication logs and API audit trails specifically for cross-project component:exec and wirelogs:view requests to identify if this vulnerability has been actively exploited. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today