Description

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-13T22:17:29.193Z",
  "pubdate": "2026-08-13T22:17:29.193Z",
  "executiveSummary": "An authentication bypass vulnerability exists in OpenChoreo prior to versions 1.0.2 and 1.1.2.\nThe vulnerability resides in the internal/cluster-gateway/server.go component, which improperly exposes caller-facing management APIs on the externally reachable agent listener without requiring authentication.\nNetwork-reachable attackers can exploit this flaw to invoke sensitive operational endpoints, specifically /api/proxy/ and /api/exec/.\nSuccessful exploitation grants unauthorized actors the ability to proxy requests to the data-plane Kubernetes API and execute arbitrary commands within workload pods in multi-cluster deployments.\nThe risk implications are severe, as unauthorized execution and API proxying can lead to complete compromise of the target Kubernetes workloads and cluster infrastructure.\nAttackers require network reachability to the externally reachable agent listener, but no authentication credentials are required to interact with the exposed endpoints.",
  "technicalDetails": "The root cause of the vulnerability is the absence of authentication enforcement on management APIs exposed via the agent listener in internal/cluster-gateway/server.go within OpenChoreo.\nThe affected component, internal/cluster-gateway/server.go, fails to validate client credentials or session tokens before processing requests routed to the agent listener.\nThe affected versions comprise all OpenChoreo deployments prior to version 1.0.2 and version 1.1.2.\nAuthentication and privilege requirements are absent for the vulnerable endpoints; any network-reachable entity can issue requests without prior authentication or high-privilege access tokens.\nNetwork exposure is high, as the vulnerable management APIs are hosted on an externally reachable listener rather than being restricted to internal networks or localhost interfaces.\nThe attack flow proceeds as follows: an unauthenticated attacker identifies the externally reachable agent listener managed by OpenChoreo. The attacker crafts HTTP requests targeting the unauthenticated management endpoints, specifically bypassing authentication checks to access /api/proxy/ and /api/exec/.\nBy invoking /api/proxy/, the attacker can forward arbitrary requests through the gateway to the underlying data-plane Kubernetes API, potentially reading or modifying cluster resources.\nBy invoking /api/exec/, the attacker can execute arbitrary commands directly inside targeted workload pods deployed across multi-cluster environments.\nThe payload behavior involves interacting directly with the exposed management routines to achieve remote command execution and unauthorized API interactions, leading to full operational compromise of the managed Kubernetes workloads."
}