Vulnerabilities in openchoreo
6 resultsVexday analysis
OpenChoreio apresenta 6 vulnerabilidades na base, todas publicadas nos últimos 90 dias, indicando risco recente e concentrado. Duas são críticas (CVSS alto), mas nenhuma está sob exploração ativa conhecida (KEV), reduzindo a pressão imediata. A fraqueza dominante é CWE-306 (falta de autenticação), exigindo revisão de controles de acesso como prioridade.
CVE-2026-73667HIGHOpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged podsEPSS 0.6%CVE-2026-73841HIGHOpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpointsEPSS 0.5%CVE-2026-73666HIGHOpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/deleteEPSS 0.5%CVE-2026-73843CRITICALOpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIsEPSS 0.3%CVE-2026-73840MEDIUMOpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)EPSS 0.2%CVE-2026-73842CRITICALOpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutationEPSS 0.2%