# CVE-2026-73843: OpenChoreo cluster-gateway authentication bypass

Source: https://junglewise.ai/threats/cve-2026-73843-openchoreo-cluster-gateway-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73843 · Severity: critical · CVSS 9.6 · Published 2026-08-13

OpenChoreo is a multi-cluster application orchestration platform that uses a control-plane component called cluster-gateway to manage data-plane operations. In multi-cluster deployments, the cluster-gateway is exposed externally to allow remote agents to connect. However, the management APIs that control sensitive workload operations (including Kubernetes API proxy and pod command execution) were served on the same public endpoint without authentication. An attacker with network access to this endpoint could perform privileged operations and fully compromise workloads on the affected data plane.

Technologies: [github.com/openchoreo/openchoreo (Go)](https://junglewise.ai/threats/technologies/github-com-openchoreo-openchoreo), [OpenChoreo](https://junglewise.ai/threats/technologies/openchoreo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenChoreo](https://junglewise.ai/threats/vendors/openchoreo).

## Quick answers

**Is CVE-2026-73843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73843 being exploited in the wild.

**How severe is CVE-2026-73843?** Critical severity, with a CVSS score of 9.6, published 13 August 2026.

**Which products and versions are affected?** github.com/openchoreo/openchoreo (Go) SEMVER:introduced=0,fixed=1.0.2, SEMVER:introduced=0,fixed=1.0.2,introduced=1.1.0,fixed=1.1.2; OpenChoreo < 1.0.2, >= 1.1.0 and < 1.1.2.

**Is there a fix for CVE-2026-73843?** Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.2, 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73843 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-73843?** Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openchoreo/openchoreo (Go): upgrade to 1.0.2, 1.1.2 or later

  ```sh
  go get github.com/openchoreo/openchoreo@v1.1.2
  ```


## Technical details

The vulnerability is a missing authentication and authorization flaw (CWE-306, CWE-862) in the OpenChoreo control-plane cluster-gateway component. The root cause is architectural: caller-facing management APIs that perform critical data-plane operations (Kubernetes API proxying, workload pod command execution) were exposed on the same network listener (public endpoint) used for legitimate data-plane agent connections, without any authentication of the caller. In multi-cluster topologies, this listener is published outside the cluster for remote agents to connect. An unauthenticated attacker able to reach this endpoint can directly invoke privileged operations normally restricted to the OpenChoreo API server and gated by its authorization system. This allows full compromise of workloads: disclosure (data access), tampering (code/configuration modification), and denial of service. The fix (versions 1.0.2, 1.1.2, 1.2.0+) moves management APIs to a separate internal listener not exposed outside the cluster, leaving only the agent-connection endpoint on the external listener. The attack vector is network-adjacent (AV:A), reflecting the requirement to reach the externally published gateway; no authentication or user interaction is required (PR:N/UI:N), and the scope changes beyond the vulnerable component.

## Affected products

- OpenChoreo OpenChoreo < 1.0.2, >= 1.1.0 and < 1.1.2

## Identifiers

- CVE-2026-73843
- GHSA-qh9r-j7rp-4x2m
- GO-2026-6362

## Timeline

- 2026-07-09: disclosed: Vulnerability published to GitHub Advisory Database
- 2026: patched: Patches released in versions 1.0.2, 1.1.2, and 1.2.0
- 2026-09-02: advisory: Security advisory published (GHSA-qh9r-j7rp-4x2m)
- 2026-08-13: other: CVE-2026-73843 published to NVD

## References

- [https://api.github.com/users/Ketharan](https://api.github.com/users/Ketharan)
- [https://github.com/Ketharan](https://github.com/Ketharan)
- [https://api.github.com/users/Ketharan/gists%7B/gist_id%7D](https://api.github.com/users/Ketharan/gists%7B/gist_id%7D)
- [https://api.github.com/users/Ketharan/repos](https://api.github.com/users/Ketharan/repos)
- [https://avatars.githubusercontent.com/u/25489203?v=4](https://avatars.githubusercontent.com/u/25489203?v=4)
- [https://api.github.com/users/Ketharan/events%7B/privacy%7D](https://api.github.com/users/Ketharan/events%7B/privacy%7D)

## Related threats

- [OpenChoreo authorization bypass in workflow run updates](https://junglewise.ai/threats/cve-2026-113727-openchoreo-is-a-developer-platform-for-kubernetes-from-1-0-0)
- [OpenChoreo cluster-gateway missing authentication and authorization in internal proxy](https://junglewise.ai/threats/cve-2026-73842-openchoreo-cluster-gateway-missing-authentication-and)
- [OpenChoreo openchoreo-api authorization bypass in exec and wirelogs endpoints](https://junglewise.ai/threats/cve-2026-73841-openchoreo-openchoreo-api-authorization-bypass-in-exec-and)
- [OpenChoreo webhook signature bypass in autobuild endpoint](https://junglewise.ai/threats/cve-2026-73840-openchoreo-webhook-signature-bypass-in-autobuild-endpoint)
- [OpenChoreo OS command injection in Workflow Plane templates](https://junglewise.ai/threats/cve-2026-73667-openchoreo-os-command-injection-in-workflow-plane-templates)