Executive brief
OpenChoreo is a platform that runs CI/CD workflows in Kubernetes pods. Workflow templates incorrectly interpolate user-supplied parameters directly into shell commands, allowing authenticated users to inject arbitrary OS commands that execute with elevated privileges in some configurations. An attacker could read source code, steal credentials and API tokens, or potentially escape the container to compromise the underlying host.
Technical details
The vulnerability is an OS command injection (CWE-78) in OpenChoreo's Workflow Plane templates. Developer-controlled Argo workflow parameters are interpolated unsanitized into shell scripts executed through `sh -c`, allowing shell metacharacters to alter command execution. Exploitation requires authentication and workflow trigger permissions. Some affected build and publish templates run Podman with `securityContext.privileged: true` and lack pod user-namespace isolation (hostUsers: false), causing injected commands to execute as UID 0 both inside the container and on the host, with full Linux capabilities. Successful exploitation allows arbitrary command execution within the pod, with potential access to mounted secrets, registry credentials, Kubernetes service account tokens, and build-time data. In worst-case scenarios with exposed host devices or kernel misconfiguration, container escape and node compromise are possible. Patches are available in versions 1.0.4, 1.1.4, and 1.2.0-rc.2, which pass parameters via container environment variables and quoted shell variables instead of direct interpolation, and enable user namespaces for privileged containers.
Affected products
- OpenChoreo OpenChoreo < 1.0.4, >= 1.1.0 and < 1.1.4, >= 1.2.0-rc.1 and < 1.2.0-rc.2
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Patched in versions 1.0.4, 1.1.4, and 1.2.0-rc.2