EUVD-2026-58516Severity by source
AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description states no client cert or token is required so PR:N not PR:L; internal listener implies adjacent AV:A, low complexity, and gateway-to-data-plane reach gives S:C with full C/I/A impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Articles & Coverage 1
AnalysisAI
Missing authentication in OpenChoreo's cluster-gateway internal API lets any network-reachable caller invoke /api/proxy/, /api/exec/, and /api/wirelogs/ without a client certificate or token, exposing tenant Kubernetes Secrets and allowing workload mutation and arbitrary command execution across every connected data plane. All deployments before 1.0.3, 1.1.3, and 1.2.0-rc.2 are affected, and the fix introduces an opt-in --internal-mtls mode plus a dedicated internal CA. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the cluster-gateway's internal API listener (CVSS AV:A, adjacent) that serves /api/proxy/, /api/exec/, and /api/wirelogs/ - typically an in-cluster position such as a compromised pod, a workload sharing the pod/service network, or a listener inadvertently exposed on a routable interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue: the CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H, base 9.0) reflects low complexity, no user interaction, and a scope change that spans from the gateway into connected data planes, which matches the described ability to read Secrets, mutate workloads, and run commands cluster-wide. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who gains a foothold on the cluster network - for example a compromised pod or a workload on the same segment as the cluster-gateway - sends unauthenticated HTTP requests to the internal /api/exec/ endpoint and executes commands inside pods on a connected data plane, then queries /api/proxy/ to dump tenant Kubernetes Secrets. Because low attack complexity and no user interaction are required, this can be scripted for rapid cross-tenant, multi-cluster compromise; no public POC was provided in the input. |
| Remediation | Vendor-released patch: upgrade to OpenChoreo 1.0.3, 1.1.3, or 1.2.0-rc.2 depending on your release line, per GHSA-rh53-xvx2-j327 and the corresponding release tags and PRs (https://github.com/openchoreo/openchoreo/pull/4256, /4258, /4259; commits 50fcae3, 93e6f10, e3da3c6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all OpenChoreo deployments in your environment and verify which versions are deployed; assess whether the internal listener is accessible from untrusted networks and document the exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today