EUVD-2026-58543Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network access with zero credentials required; high confidentiality from open catalog and log reads; low integrity from catalog location manipulation only; no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
AnalysisAI
Unauthenticated API access in OpenChoreo's Backstage backend exposes all /api/* routes to any network-reachable attacker, enabling catalog enumeration, scaffolder log reads, and catalog location creation or deletion without credentials. The root cause is two Backstage safety flags - dangerouslyDisableDefaultAuthPolicy and dangerouslyAllowOutsideDevelopment - hardcoded to true in both app-config.yaml and app-config.production.yaml, effectively disabling Backstage's authentication layer in all pre-fix deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - this is remote unauthenticated exploitation against the default shipped configuration of OpenChoreo Backstage plugins. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) accurately reflects the exposure: zero-complexity, zero-credential network exploitation granting high confidentiality impact and limited write capability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an OpenChoreo Backstage instance sends unauthenticated HTTP GET requests to `/api/catalog/entities` to enumerate the complete software catalog - including service names, ownership, and infrastructure metadata - then reads scaffolder template execution logs via `/api/scaffolder/v2/tasks/{id}/eventstream`, which may expose secrets or deployment parameters. The attacker subsequently issues POST requests to `/api/catalog/locations` to register attacker-controlled source URLs, potentially poisoning the catalog with malicious component definitions visible to all developers using the platform. |
| Remediation | Upgrade to OpenChoreo Backstage plugins v1.0.4, v1.1.4, or v1.2.1 per your release branch, as confirmed by GitHub release tags and the vendor advisory at https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all OpenChoreo Backstage deployments and identify current versions; review API access logs for suspicious activity patterns and unauthorized queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today