{"action":"Upgrade github.com/openchoreo/openchoreo to 1.0.2 or later.","affected":[{"fixed":"1.0.2","introduced":"0"},{"fixed":"1.1.2","introduced":"1.1.0"}],"component":"github.com/openchoreo/openchoreo","cve_ids":["CVE-2026-73843"],"ecosystem":"Go","epss":0.00482,"exploited":false,"fixed_versions":["1.0.2","1.1.2"],"ghsa_id":"GHSA-qh9r-j7rp-4x2m","id":"tcs_01M5KFK28D41D3DJ0H6RXJPFSS","modified_at":"2026-09-10T15:25:56.771191095Z","published_at":"2026-09-02T23:43:55Z","references":["https://osv.dev/vulnerability/GHSA-qh9r-j7rp-4x2m","https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m","https://nvd.nist.gov/vuln/detail/CVE-2026-73843","https://github.com/openchoreo/openchoreo/pull/4122","https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce","https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a","https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f","https://github.com/openchoreo/openchoreo","https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2","https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2","https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-qh9r-j7rp-4x2m","url":"https://osv.dev/vulnerability/GHSA-qh9r-j7rp-4x2m"}],"summary":"OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs"}