Is CVE-2026-73842 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73842 being exploited in the wild.

How severe is CVE-2026-73842?

Critical severity, with a CVSS score of 9, published 13 August 2026.

Which products and versions are affected?

github.com/openchoreo/openchoreo (Go) SEMVER:introduced=0,fixed=1.0.3, SEMVER:introduced=0,fixed=1.0.3,introduced=1.1.0,fixed=1.1.3,introduced=1.2.0-rc.1,fixed=1.2.0; OpenChoreo Cluster-Gateway = 1.1.0 = 1.2.0-rc.1 < 1.2.0-rc.2.

Is there a fix for CVE-2026-73842?

Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.3, 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73842 attacked?

It is attacked over the network or from the adjacent network, in a hosted service.

Am I affected by CVE-2026-73842?

Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo Cluster-Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73842: OpenChoreo cluster-gateway missing authentication and authorization in internal proxy

Q: Is there a fix for CVE-2026-73842?

Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.3, 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-73842 attacked?

It is attacked over the network or from the adjacent network, in a hosted service.

Q: Am I affected by CVE-2026-73842?

Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo Cluster-Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73842 · Severity: critical · CVSS 9 · Published 2026-08-13

OpenChoreo's cluster-gateway is a control-plane component that manages requests to Kubernetes clusters across multiple data planes. The internal management APIs expose no authentication, allowing any network-adjacent user to read sensitive configuration data (database passwords, API keys, TLS certificates), modify or delete workloads, and execute arbitrary commands in pods across all connected clusters. Organizations relying on this for multi-tenant or multi-region deployments face potential data breaches and operational disruption.

Technologies: github.com/openchoreo/openchoreo (Go). Vendors: Go, OpenChoreo.

Quick answers

Is CVE-2026-73842 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73842 being exploited in the wild.
How severe is CVE-2026-73842?: Critical severity, with a CVSS score of 9, published 13 August 2026.
Which products and versions are affected?: github.com/openchoreo/openchoreo (Go) SEMVER:introduced=0,fixed=1.0.3, SEMVER:introduced=0,fixed=1.0.3,introduced=1.1.0,fixed=1.1.3,introduced=1.2.0-rc.1,fixed=1.2.0; OpenChoreo Cluster-Gateway < 1.0.3, >= 1.1.0 < 1.1.3, >= 1.2.0-rc.1 < 1.2.0-rc.2.
Is there a fix for CVE-2026-73842?: Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.3, 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73842 attacked?: It is attacked over the network or from the adjacent network, in a hosted service.
Am I affected by CVE-2026-73842?: Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo Cluster-Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openchoreo/openchoreo (Go): upgrade to 1.0.3, 1.2.0 or later
```
go get github.com/openchoreo/openchoreo@v1.2.0
```

Technical details

The cluster-gateway internal listener lacks caller authentication entirely, and its request validator permits both mutating HTTP methods (POST, PUT, DELETE) and reads of Secrets in tenant namespaces—contradicting the client library's documentation marking these as "read-only." An attacker reaching the internal listener (network reachability depends on deployment configuration) can tunneled access to connected data-plane Kubernetes APIs with no per-caller access control. Attack preconditions include network reachability to the internal listener; no client certificate, token, or privileges are required. Exploitation allows secret exfiltration (database credentials, cloud/KMS keys, TLS private keys), workload tampering, and pod exec. The vulnerability is compounded by being a compensating authorization layer missing from GHSA-52gf-6rpq-fgmx. Patches are available in versions 1.0.3, 1.1.3, and 1.2.0; upgrade paths are documented.

Affected products

OpenChoreo cluster-gateway < 1.0.3, >= 1.1.0 < 1.1.3, >= 1.2.0-rc.1 < 1.2.0-rc.2

Identifiers

CVE-2026-73842
GHSA-rh53-xvx2-j327
GO-2026-6428

Timeline

2026-07-27: disclosed: Initial advisory published on GitHub
2026-09-04: patched: Patches released: v1.0.3, v1.1.3, v1.2.0
2026-09-04: advisory: CVE-2026-73842 assigned and advisory finalized

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.