Description

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T22:17:28.393Z",
  "pubdate": "2026-08-13T22:17:28.393Z",
  "executiveSummary": "OpenChoreo versions prior to 1.0.4, 1.1.4, and 1.2.1 suffer from an authentication bypass vulnerability resulting from hardcoded security configurations within the Backstage backend. Specifically, the configuration properties backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment were explicitly forced to true, exposing the /api/* endpoint structure without requiring authentication.\nThis flaw impacts the OpenChoreo developer platform deployed on Kubernetes, presenting severe risk implications regarding unauthorized data exposure and modification. Attackers possess the capability to perform unauthenticated catalog reads, access sensitive scaffolder log outputs, and execute administrative actions such as creating or deleting catalog locations without possessing valid credentials.\nThe exploitation requirements are minimal, as the attack surface is exposed directly over the network to any unauthenticated principal capable of reaching the Backstage API endpoints. Remediation requires upgrading the affected OpenChoreo instances to versions 1.0.4, 1.1.4, 1.2.1, or later, where default authentication policies are correctly enforced.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure default configurations hardcoded into the OpenChoreo Backstage backend implementation. The application explicitly sets backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true. These parameters govern the global API authentication enforcement and the permission model for guest authentication outside of local development environments, respectively.\nThe vulnerable component is the OpenChoreo Backstage backend API routing and authentication middleware layer, affecting all deployments running versions prior to 1.0.4, 1.1.4, and 1.2.1. Because the default authorization policy is disabled and guest access is globally permitted, the system fails to validate JSON Web Tokens (JWT) or session credentials presented against protected REST API routes.\nNetwork exposure is broad, affecting any Kubernetes cluster deployment where the OpenChoreo Backstage ingress or service ports are reachable by internal users or external actors depending on network zoning. No authentication requirements or privilege requirements are enforced for targeted API paths.\nThe attack flow proceeds as follows: 1) An unauthenticated threat actor targets the OpenChoreo Backstage instance via HTTP requests directed at the /api/* namespace. 2) The backend authentication middleware evaluates the request against the hardcoded configuration settings. 3) Due to backend.auth.dangerouslyDisableDefaultAuthPolicy being set to true, access control checks are bypassed entirely. 4) The guest provider configuration further permits unrestricted access actions.\nPost-exploitation impact includes unauthorized information disclosure through unauthenticated catalog reads and scaffolder log extraction, as well as integrity violations through unauthorized catalog location creation and deletion operations. Attackers can leverage these capabilities to map internal infrastructure, harvest sensitive build and deployment logs, and manipulate the application catalog state."
}