CVE-2026-73842
2 advisories.
Go/github.com/openchoreo/openchoreo CVE-2026-73842: critical 9, EPSS 0.27%
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
Action: Upgrade github.com/openchoreo/openchoreo to 1.0.3 or later.
go get github.com/openchoreo/openchoreo@v1.0.3go get github.com/openchoreo/openchoreo@v1.1.3go get github.com/openchoreo/openchoreo@v1.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.3 | - |
| 1.1.0 | 1.1.3 | - |
| 1.2.0-rc.1 | 1.2.0 | - |
Fixed versions
| 1.0.3 | 1.1.3 | 1.2.0 |
Sources
- osv: GHSA-rh53-xvx2-j327
- https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327
- https://nvd.nist.gov/vuln/detail/CVE-2026-73842
- https://github.com/openchoreo/openchoreo/pull/4256
- https://github.com/openchoreo/openchoreo/pull/4258
- https://github.com/openchoreo/openchoreo/pull/4259
- https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04
- https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129
- https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a
- https://github.com/openchoreo/openchoreo
- https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3
- https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3
- https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2
CVE-2026-73842 · published · modified · JSON
Go/github.com/openchoreo/openchoreo CVE-2026-73842: unknown, EPSS 0.27%
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation in github.com/openchoreo/openchoreo
Action: Upgrade github.com/openchoreo/openchoreo to 1.0.3 or later.
go get github.com/openchoreo/openchoreo@v1.0.3go get github.com/openchoreo/openchoreo@v1.1.3go get github.com/openchoreo/openchoreo@v1.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.3 | - |
| 1.1.0 | 1.1.3 | - |
| 1.2.0-rc.1 | 1.2.0 | - |
Fixed versions
| 1.0.3 | 1.1.3 | 1.2.0 |
Sources
- osv: GO-2026-6428
- https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327
- https://nvd.nist.gov/vuln/detail/CVE-2026-73842
- https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04
- https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129
- https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a
- https://github.com/openchoreo/openchoreo/pull/4256
- https://github.com/openchoreo/openchoreo/pull/4258
- https://github.com/openchoreo/openchoreo/pull/4259
- https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3
- https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3
- https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2
CVE-2026-73842 · published · modified · JSON