OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs /api/proxy/, /api/exec/, /api/wirelogs/ that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP...

SUSE CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

GHSA-QH9R-J7RP-4X2M OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...

AZL-99300 CVE-2026-78222 affecting package nginx for versions less than 1.30.4-1

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

DEBIAN-CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

DEBIAN-CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

UBUNTU-CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

EUVD-2026-70144

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-78222

NGINX JavaScript (ngx_http_js_module) is vulnerable to a NULL Pointer Dereference (CWE-476) when a malformed HTTP response received by ngx.fetch() is processed and trusted JavaScript reads Response.statusText, causing an NGINX worker crash . Exploitation requires control or influence over the fet...

CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

CVE-2026-18329

NGINX JavaScript (njs) and QuickJS (qjs) engines contain an authentication/authorization bypass in the ngx_http_js_module . When a js_access handler performs asynchronous request body processing and an exception is thrown before an explicit denial is returned, the phase fails open , allowing unau...

EUVD-2026-70138

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

PT-2026-84756

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a js access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker c...

PT-2026-84763

Name of the Vulnerable Software and Affected Versions NGINX JavaScript affected versions not specified Description A flaw in NGINX JavaScript allows a remote attacker to cause a denial-of-service DoS on the system. The issue occurs when the ngx.fetch function receives a malformed HTTP response an...

CVE-2026-78222: NULL Pointer Dereference

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...