CVE-2026-73841

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead...

PT-2026-71924

Name of the Vulnerable Software and Affected Versions OpenChoreo versions 1.2.0-rc.1 through 1.2.0 Description An authorization flaw exists in the openchoreo-api where the system uses a caller-supplied project query parameter instead of the comp.Spec.Owner.ProjectName to authorize component:exec...