Is CVE-2026-73667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73667 being exploited in the wild.

How severe is CVE-2026-73667?

High severity, with a CVSS score of 8.8, published 13 August 2026.

Which products and versions are affected?

github.com/openchoreo/openchoreo (Go) SEMVER:introduced=0,fixed=1.0.4, SEMVER:introduced=0,fixed=1.0.4,introduced=1.1.0,fixed=1.1.4,introduced=1.2.0-rc.1,fixed=1.2.0-rc.2.

Is there a fix for CVE-2026-73667?

Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.4, 1.2.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73667 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-73667?

Check whether you run github.com/openchoreo/openchoreo (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73667: OpenChoreo OS command injection in Workflow Plane templates

CVE-2026-73667 · Severity: high · CVSS 8.8 · Published 2026-08-13

OpenChoreo is a platform that runs CI/CD workflows in Kubernetes pods. Workflow templates incorrectly interpolate user-supplied parameters directly into shell commands, allowing authenticated users to inject arbitrary OS commands that execute with elevated privileges in some configurations. An attacker could read source code, steal credentials and API tokens, or potentially escape the container to compromise the underlying host.

Technologies: github.com/openchoreo/openchoreo (Go). Vendors: Go.

Quick answers

Is CVE-2026-73667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73667 being exploited in the wild.
How severe is CVE-2026-73667?: High severity, with a CVSS score of 8.8, published 13 August 2026.
Which products and versions are affected?: github.com/openchoreo/openchoreo (Go) SEMVER:introduced=0,fixed=1.0.4, SEMVER:introduced=0,fixed=1.0.4,introduced=1.1.0,fixed=1.1.4,introduced=1.2.0-rc.1,fixed=1.2.0-rc.2.
Is there a fix for CVE-2026-73667?: Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.4, 1.2.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73667 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-73667?: Check whether you run github.com/openchoreo/openchoreo (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openchoreo/openchoreo (Go): upgrade to 1.0.4, 1.2.0-rc.2 or later
```
go get github.com/openchoreo/openchoreo@v1.2.0-rc.2
```

Technical details

The vulnerability is an OS command injection (CWE-78) in OpenChoreo's Workflow Plane templates. Developer-controlled Argo workflow parameters are interpolated unsanitized into shell scripts executed through `sh -c`, allowing shell metacharacters to alter command execution. Exploitation requires authentication and workflow trigger permissions. Some affected build and publish templates run Podman with `securityContext.privileged: true` and lack pod user-namespace isolation (hostUsers: false), causing injected commands to execute as UID 0 both inside the container and on the host, with full Linux capabilities. Successful exploitation allows arbitrary command execution within the pod, with potential access to mounted secrets, registry credentials, Kubernetes service account tokens, and build-time data. In worst-case scenarios with exposed host devices or kernel misconfiguration, container escape and node compromise are possible. Patches are available in versions 1.0.4, 1.1.4, and 1.2.0-rc.2, which pass parameters via container environment variables and quoted shell variables instead of direct interpolation, and enable user namespaces for privileged containers.

Affected products

OpenChoreo OpenChoreo < 1.0.4, >= 1.1.0 and < 1.1.4, >= 1.2.0-rc.1 and < 1.2.0-rc.2

Identifiers

CVE-2026-73667
GHSA-2mw5-23gm-pccq
GO-2026-6357

Timeline

2026-09-02: disclosed
2026-09-02: patched: Patched in versions 1.0.4, 1.1.4, and 1.2.0-rc.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.