EUVD-2026-58518
GHSA-qh9r-j7rp-4x2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach cluster-gateway agent listener
-
DeliverySend unauthenticated /api/proxy/ request
-
ExploitProxy to data-plane Kubernetes API
-
ExecutionInvoke /api/exec/ on workload pod
-
ImpactExecute commands, pivot across clusters
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a multi-cluster OpenChoreo deployment (before 1.0.2/1.1.2) where the cluster-gateway agent listener - which in the vulnerable design co-hosts the /api/proxy/ and /api/exec/ endpoints on the public port 8443 - is network-reachable by the attacker. No authentication, credentials, or user interaction are needed (PR:N/UI:N/AC:L), and it works against the default configuration of affected versions because the routes were registered on the public mux. Limiting factors: exploitation is bounded by network reachability of the gateway (NVD scores this AV:A/adjacent, though the advisory text describes an externally reachable listener suggesting broader network access), and deployments without a reachable agent listener are less exposed; the flaw is fully removed once /api/* routes are moved to the internal-only port 8444. |
| Impact | All available signals point to genuine high priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 9.6) indicates low-complexity, unauthenticated exploitation with a scope change and total compromise of confidentiality, integrity and availability - consistent with the description's claim of proxying the Kubernetes API and executing commands in pods. One tension to verify: NVD assigns AV:A (adjacent), yet the description repeatedly stresses an 'externally reachable' listener and 'network-reachable attackers,' which argues for AV:N; if the gateway is genuinely internet- or cross-cluster-reachable, real-world risk is higher than AV:A implies. EPSS and KEV data were not provided and no POC was referenced, so there is no evidence of active exploitation - this is a severe design flaw rather than a confirmed in-the-wild campaign. Given the impact (cross-cluster RCE via the Kubernetes API), the absence of a public exploit should not lower prioritization; unauthenticated K8s data-plane access is trivially automatable once the endpoint is located. |
| Exploit ScenarioDerived | An attacker who can reach the OpenChoreo cluster-gateway listener (for example from an adjacent network segment or an over-exposed data-plane endpoint) sends unauthenticated requests to /api/proxy/ to tunnel to a data-plane cluster's Kubernetes API, then calls /api/exec/ to run commands inside a workload pod. With low attack complexity and no authentication or user interaction required, this yields remote code execution and cross-cluster compromise; no public POC was referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Missing authentication on OpenChoreo's cluster-gateway (before 1.0.2 and 1.1.2) exposed caller-facing management APIs on the same externally reachable listener used for agent WebSocket traffic, letting network-reachable attackers hit /api/proxy/ and /api/exec/ without any credentials. In multi-cluster deployments this permits proxying the data-plane Kubernetes API and executing commands inside workload pods, effectively yielding cross-cluster control. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-qh9r-j7rp-4x2m) and CVSS 9.6 mark it as critical.
RemediationAI
Vendor-released patch: upgrade to OpenChoreo 1.0.2 (1.0.x line) or 1.1.2 (1.1.x line), which move the /api/* management endpoints onto a separate internal listener (port 8444, flag --internal-port / env AGENT_INTERNAL_PORT) intended for in-cluster callers only, leaving the public listener serving only the /ws agent WebSocket. After upgrading, update CLUSTER_GATEWAY_URL / the controllerManager clusterGateway.url value from :8443 to :8444 as the new deployment defaults do (per the Helm values.yaml and values.schema.json changes) so in-cluster callers reach the internal port. If you cannot patch immediately, restrict network exposure of the cluster-gateway: use Kubernetes NetworkPolicies, firewall rules, or service-mesh authorization so the gateway's :8443 listener is reachable only by legitimate remote data-plane agents and so /api/proxy/ and /api/exec/ are not reachable from untrusted networks - the trade-off is that overly broad blocks can break legitimate data-plane connectivity, so scope rules to known agent source addresses. Advisory and fix references: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m, https://github.com/openchoreo/openchoreo/pull/4122, and commit https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenChoreo is an open-source internal developer platform built on Kubernetes that federates a control plane with one or more remote data-plane clusters. The affected component is the cluster-gateway (internal/cluster-gateway/server.go, cmd/cluster-gateway), a Go service that terminates agent WebSocket connections from remote data planes and also exposes management endpoints - /api/proxy/ (an HTTP proxy to data-plane services and the Kubernetes API) and /api/exec/ (command execution in workload pods). The root cause is CWE-306 (Missing Authentication for Critical Function): a single http.ServeMux registered both the public /ws agent endpoint and the sensitive /api/* routes on one listener (port 8443), so anything that could reach the gateway endpoint could invoke privileged operations. The fix splits this into two listeners - a public mux serving only /ws and a new internal mux (port 8444, AGENT_INTERNAL_PORT) serving /api/* for in-cluster callers only - as reflected in the Helm deployment/service manifests and the cluster-gateway URL default moving from :8443 to :8444.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description says the listener is externally reachable by network attackers, so AV:N rather than NVD's AV:A; no auth or interaction (PR:N/UI:N), and pivoting into data-plane clusters/pods changes scope (S:C) with full C/I/A loss.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.
Articles & Coverage 1
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
OpenChoreo cluster-gateway versions before 1.0.2 and 1.1.2 expose unauthenticated remote access to critical management APIs, allowing external attackers to proxy Kubernetes data-plane APIs and execute arbitrary commands across cluster deployments. Multi-cluster environments face immediate risk of complete infrastructure compromise without authentication enforcement. This vulnerability requires urgent containment and network isolation pending patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict firewall policies limiting cluster-gateway access to internal/trusted networks only; deploy Web Application Firewall (WAF) or authentication-enforcing reverse proxy blocking /api/proxy/ and /api/exec/; enable detailed API access logging with real-time alerting for authentication failures and anomalous patterns; implement network segmentation between clusters to contain lateral movement if one cluster is compromised; monitor for exploitation indicators (mass API proxy calls, unexpected pod exec commands) pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB