Description

OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in and read wirelogs from components owned by other projects in the same namespace. This vulnerability is fixed in 1.2.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T22:17:28.900Z",
  "pubdate": "2026-08-13T22:17:28.900Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the OpenChoreo developer platform for Kubernetes, specifically within the API handlers responsible for component execution and wire logs viewing. The flaw arises due to improper validation of authorization boundaries, where security checks rely on a caller-supplied project query parameter rather than verifying the actual ownership metadata defined in the component specification (comp.Spec.Owner.ProjectName). This enables an authenticated attacker possessing only project-scoped grants to execute arbitrary commands inside and retrieve sensitive wire logs from components belonging to entirely different projects residing within the same Kubernetes namespace. The vulnerability impacts OpenChoreo versions from 1.2.0-rc.1 through 1.2.0. The risk implications include horizontal privilege escalation, unauthorized cross-project data disclosure, and remote code execution within affected container components. Exploitation requires valid authentication and a project-scoped access grant within the shared namespace, allowing the attacker to manipulate API request parameters to bypass multi-tenant isolation barriers.",
  "technicalDetails": "The vulnerability is rooted in flawed access control logic implemented within the API handler files internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go of the OpenChoreo platform. When processing requests for component execution and wire logs retrieval, the application enforces authorization for the component:exec and wirelogs:view capabilities by evaluating the user-supplied project query parameter provided in the HTTP request context. This implementation trusts the input provided directly by the caller instead of deriving and validating the target project context securely from the underlying authoritative resource specification, specifically comp.Spec.Owner.ProjectName. Consequently, an attacker authenticated with valid credentials and a legitimate project-scoped grant in a specific namespace can craft API requests targeting components in foreign projects within that same namespace by simply modifying the project query parameter to match the destination project identifier. The vulnerable execution flow proceeds as follows: 1) The attacker initiates an API call to the exec or wirelogs endpoints. 2) The attacker supplies a manipulated project query parameter corresponding to a victim project. 3) The backend authorization check validates the user permissions against the supplied query parameter rather than the true owner of the target component. 4) The authorization check incorrectly succeeds due to the trust placed in the untrusted input. 5) The API controller permits the execution of interactive commands inside the target component or exposes sensitive wire logs data across project boundaries. This bypasses the multi-tenancy isolation mechanisms enforced by the platform, granting unauthorized users capabilities far exceeding their assigned project-scoped privileges. The vulnerability affects OpenChoreo versions 1.2.0-rc.1 up to and including 1.2.0, and requires network exposure to the OpenChoreo API endpoints along with low-privileged, project-scoped authentication."
}