Cluster-Gateway (< 1.0.3, 1.1.0-1.1.2, 1.2.0-Rc.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cluster-gateway--1.0.3-1.1.0-1.1.2-1.2.0-rc.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 05 Sep 2026 00:07:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenChoreo Cluster-Gateway Authentication Bypass and RCEhttps://feed.craftedsignal.io/briefs/2026-09-openchoreo-auth-bypass/Sat, 05 Sep 2026 00:07:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-openchoreo-auth-bypass/The OpenChoreo cluster-gateway fails to authenticate callers to internal management APIs, allowing unauthorized actors to perform arbitrary Kubernetes API mutations and access Secrets across connected data planes.The OpenChoreo cluster-gateway component suffers from a critical authentication bypass vulnerability (CVE-2026-73842) affecting its internal management APIs, specifically /api/proxy/, /api/exec/, and /api/wirelogs/. These endpoints are designed to tunnel requests to connected Kubernetes data planes but lack any caller authentication or authorization checks. Furthermore, despite being intended for read-only telemetry, the validator allows arbitrary HTTP methods, including those that mutate state or disclose sensitive information. An attacker with network reach to the internal listener can interact with the downstream Kubernetes APIs of any connected data plane as if they were the cluster-gateway itself. This vulnerability creates a significant risk of Secret exfiltration, arbitrary workload modification, and remote code execution via pod exec functionality.

Attack Chain

  1. Attacker gains network reach to the OpenChoreo cluster-gateway internal management port.
  2. Attacker probes the internal API endpoints: /api/proxy/, /api/exec/, or /api/wirelogs/.
  3. Attacker crafts a malicious request to /api/proxy/ to reach the Kubernetes API server of a connected data plane.
  4. Attacker bypasses the non-existent authentication mechanism, as the gateway blindly forwards the request.
  5. Attacker sends a POST or PUT request to create or modify Kubernetes resources (e.g., Deployments or Services) in a target namespace.
  6. Attacker sends a request to /api/exec/ to execute arbitrary commands inside a target pod, achieving RCE.
  7. Attacker reads Kubernetes Secrets in tenant namespaces to harvest database credentials or cloud service keys.

Impact

The vulnerability grants unauthorized full control over connected Kubernetes data planes. Successful exploitation leads to the disclosure of sensitive credentials stored in Kubernetes Secrets, the deployment of malicious workloads, and remote command execution within the tenant environment. This affects all versions of OpenChoreo prior to the specified fixed releases (1.0.3, 1.1.3, 1.2.0), effectively neutralizing data-plane level security controls.

Recommendation

  1. Upgrade OpenChoreo immediately to version 1.0.3, 1.1.3, or 1.2.0 to resolve CVE-2026-73842.
  2. Implement strict network segmentation to restrict access to the cluster-gateway internal listener.
  3. Ensure that internal management ports are not reachable from untrusted workload namespaces using Kubernetes NetworkPolicies.
  4. Audit logs for anomalous HTTP POST or PUT requests to /api/proxy/ that target the Kubernetes API server.
]]>criticaladvisoryauthentication-bypasskubernetescloud