Security readout for executives and security teams
Plain-English summary
A network-reachable attacker could control OpenChoreo data-plane operations without signing in, potentially accessing Kubernetes resources and running commands inside workload pods. Multi-cluster environments using vulnerable releases face possible compromise of confidentiality, integrity, and availability.
Executive priority
Treat as an immediate remediation item for vulnerable multi-cluster deployments. The flaw requires no account and can enable workload command execution with broad business impact. Patch exposed or broadly reachable gateways first, then investigate suspicious activity because upgrading does not determine whether earlier compromise occurred.
Technical view
Before versions 1.0.2 and 1.1.2, OpenChoreo exposed cluster-gateway management APIs on an externally reachable agent listener without authentication. Attackers with network reachability could invoke proxy and execution operations, proxy the data-plane Kubernetes API, and execute commands in workload pods. CVSS 3.1 rates this 9.6.
Likely exposure
Exposure requires OpenChoreo versions below 1.0.2 or versions 1.1.0 through 1.1.1, a multi-cluster deployment, and network reachability to the affected agent listener. Public-internet exposure is not established by the supplied evidence; review internal, partner, and adjacent-network paths.
Exploitation context
No active exploitation is established: the source bundle states this CVE is not in KEV and provides no cited exploitation reports. Exploitation requires network access but no privileges or user interaction, and successful abuse could cross security boundaries into data-plane workloads.
Researcher notes
The core weakness combines missing authentication, unintended external exposure, and missing authorization enforcement, mapped to CWE-306, CWE-668, and CWE-862. Scope changes because management-plane access can affect data-plane Kubernetes resources. The supplied evidence identifies fixes but does not establish exploit availability, observed attacks, or exposure prevalence.
Mitigation direction
- Upgrade affected 1.0.x deployments to OpenChoreo 1.0.2 or later.
- Upgrade affected 1.1.x deployments to OpenChoreo 1.1.2 or later.
- Restrict network access to cluster-gateway agent listeners until upgrades are complete.
- Prioritize credential, workload, and Kubernetes access review if unexplained management activity is found.
Validation and detection
- Inventory OpenChoreo versions across every management and data-plane cluster.
- Identify whether cluster-gateway agent listeners are reachable from untrusted or adjacent networks.
- Review logs for unexpected proxy or workload-execution operations before and after patching.
- Verify approved non-production tests show management operations reject unauthenticated callers after upgrading.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-668: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-73843 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H2.86GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2mCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/openchoreo/openchoreo/pull/4122CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ceCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3aCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8fCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Exposure of Resource to Wrong Sphere
Exposure of Resource to Wrong Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.