CVE-2026-73841

creationtimestamp| type| source ---|---|--- 2026-08-14 00:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msyu3hbksu2r 2026-08-14 00:49:51+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3msywtf7dtm2n 2026-09-03 02:33:26+00:00| seen|...

CVE-2026-73841 OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead...