Unauthenticated API Access in OpenChoreo Cluster-Gateway

OpenChoreo (CVE-2026-73843) contains a critical authentication flaw in its cluster-gateway component. In multi-cluster topologies, the cluster-gateway provides an externally published endpoint to facilitate connectivity for remote data-plane agents. It was discovered that the management APIs intended for internal use were erroneously hosted on this same externally accessible network listener. Because these management APIs lacked authentication or authorization checks, any party with network reachability to the cluster-gateway endpoint can interact with privileged data-plane operations. This exposes the ability to proxy the data plane's underlying Kubernetes API and execute arbitrary commands within workload pods. The vulnerability affects versions of the OpenChoreo cluster-gateway below 1.0.2, those between 1.1.0 and 1.1.1, and the 1.2.0 release line. The vulnerability is mitigated by moving management APIs to a non-public internal listener, restricting access to the external-facing gateway to agent-connection traffic only.

Attack Chain

1. Attacker performs network reconnaissance to identify exposed OpenChoreo cluster-gateway endpoints.
2. Attacker confirms the target is a multi-cluster deployment with an externally published listener.
3. Attacker sends unauthenticated HTTP requests to the identified management API paths on the gateway listener.
4. Attacker invokes privileged API operations intended for the OpenChoreo control-plane.
5. Attacker proxies requests to the underlying data-plane Kubernetes API.
6. Attacker leverages the proxied API access to target specific workload pods.
7. Attacker executes arbitrary commands or manipulates workloads, leading to full compromise.

Impact

Successful exploitation leads to a complete compromise of the data-plane workloads. This includes unauthorized data disclosure, unauthorized modification of services, and potential denial of service. The impact is significant for organizations relying on OpenChoreo for multi-cluster management, as the vulnerability bypasses existing control-plane authorization, granting an unauthenticated attacker the same privileges as an authenticated internal client.

Recommendation

Prioritized actions for addressing CVE-2026-73843:

• Upgrade OpenChoreo cluster-gateway to versions 1.0.2, 1.1.2, or 1.2.0 immediately to move management APIs to a secure internal listener.
• For deployments that cannot be patched immediately, apply firewall or network policy rules to restrict the externally published gateway endpoint to only allow traffic from authorized data-plane source addresses.
• Review ingress and network telemetry to identify unauthorized access attempts to the management API paths on the cluster-gateway listener.