Executive brief
OpenChoreo is a Kubernetes developer platform that includes a Backstage backend for managing application catalogs and deployment scaffolding. In versions prior to 1.0.4, 1.1.4, and 1.2.1, the platform hardcoded dangerous authentication settings, disabling access controls on API endpoints and allowing anyone to read sensitive information, modify catalog records, and access deployment logs without logging in. This allows unauthorized users to gain visibility into internal applications, steal deployment secrets, and disrupt catalog operations.
Technical details
The vulnerability is an authentication bypass caused by hardcoding two insecure configuration flags in the Backstage backend: backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment were both set to true by default. This disables the default authorization policy and enables guest access from outside the development environment, exposing all /api/* endpoints without authentication. An unauthenticated attacker with network access to the backend API can read the application catalog, access scaffolder logs (which may contain secrets), and create or delete catalog locations. The vulnerability requires no authentication or user interaction. Patches are available in versions 1.0.4, 1.1.4, and 1.2.1, which conditionally enable these flags only in guest mode rather than unconditionally.
Affected products
- OpenChoreo Backstage prior to 1.0.4, 1.1.4, and 1.2.1
Timeline
- 2026-08-13: disclosed
- 2026: patched: Fixed in versions 1.0.4, 1.1.4, and 1.2.1