CVE-2026-73666: falha de alta gravidade em openchoreo backstage-plugins
OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.7%
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
openchoreo · backstage-pluginsReferências
https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52https://github.com/openchoreo/backstage-plugins/pull/709https://github.com/openchoreo/backstage-plugins/pull/712https://github.com/openchoreo/backstage-plugins/pull/713https://github.com/openchoreo/backstage-plugins/pull/716https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh