CVE-2026-104355

A flaw was found in Temporal Server. In a multi-cluster deployment, the server fails to verify whether inbound replication tasks apply only to global namespaces. An attacker controlling a connected peer cluster can exploit this vulnerability by sending replication updates that overwrite...

EUVD-2026-97768

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-104355 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-104355: Incorrect Authorization

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

PT-2026-110872

Name of the Vulnerable Software and Affected Versions Temporal Server affected versions not specified Description In multi-cluster deployments, a connected peer cluster can modify a local namespace on a receiving cluster. This occurs because the receiving cluster applies inbound namespace...

SUSE CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

EUVD-2026-58518

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs...

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...

CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-69129

KubePi , a Kubernetes multi-cluster management panel by 1Panel-dev, contains an authorization flaw in versions up to and including 2.0.0 . Cluster-scoped APIs do not consistently validate per-cluster access, meaning an authenticated user granted management rights over one cluster can, under certa...

CVE-2026-69129

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-69129: Authorization Bypass Through User-Controlled Key

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

PT-2026-71926

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.2 OpenChoreo versions prior to 1.1.2 Description Management APIs served by internal/cluster-gateway/server.go on the externally reachable agent listener lack authentication. This allows network-reachable...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' through the impersonation middleware in pkg/auth/requests/sar/middleware.go and the SAR wiring in pkg/multiclustermanager/routes.go. An authenticated user can gain administrative access...