x/vulndb: potential Go vuln in github.com/openchoreo/openchoreo: GHSA-rh53-xvx2-j327

[GoVulnBot]

Advisory GHSA-rh53-xvx2-j327 references a vulnerability in the following Go modules:

Module
github.com/openchoreo/openchoreo

Description:

Summary

The OpenChoreo control-plane cluster-gateway exposes internal management APIs (/api/proxy/, /api/exec/, /api/wirelogs/) that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP methods and reads of Secrets in tenant namespaces (only kube-system Secrets are blocked), so although the client library documents these requests as "read-only," the server enforces no such restriction. Any party able to reach the internal listener can — with no client certificate or token �...

References:

• ADVISORY: GHSA-rh53-xvx2-j327
• ADVISORY: GHSA-rh53-xvx2-j327
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2026-73842
• FIX: openchoreo/openchoreo@50fcae3
• FIX: openchoreo/openchoreo@93e6f10
• FIX: openchoreo/openchoreo@e3da3c6
• FIX: feat: add mtls to cluster gateway communication from internal components openchoreo/openchoreo#4256
• FIX: feat: add mtls to cluster gateway communication from internal components openchoreo/openchoreo#4258
• FIX: feat: add mtls to cluster gateway communication from internal components openchoreo/openchoreo#4259
• WEB: https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3
• WEB: https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3
• WEB: https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/openchoreo/openchoreo
      versions:
        - fixed: 1.0.3
        - introduced: 1.1.0
        - fixed: 1.1.3
      non_go_versions:
        - introduced: TODO (earliest fixed "1.2.0", vuln range ">= 1.2.0-rc.1, < 1.2.0-rc.2")
      vulnerable_at: 1.1.2
summary: |-
    OpenChoreo: cluster-gateway internal proxy performs no caller authentication and
    is not read-only — data-plane Secret disclosure and arbitrary Kubernetes
    mutation in github.com/openchoreo/openchoreo
cves:
    - CVE-2026-73842
ghsas:
    - GHSA-rh53-xvx2-j327
references:
    - advisory: https://github.com/advisories/GHSA-rh53-xvx2-j327
    - advisory: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-73842
    - fix: https://github.com/openchoreo/openchoreo/commit/50fcae3f1753fd0ac3ae655a3fc080a761c49c04
    - fix: https://github.com/openchoreo/openchoreo/commit/93e6f10953cfc249af2222ddb6730d4b0a729129
    - fix: https://github.com/openchoreo/openchoreo/commit/e3da3c63dcf0895c693cb17ce142ef95e959b62a
    - fix: https://github.com/openchoreo/openchoreo/pull/4256
    - fix: https://github.com/openchoreo/openchoreo/pull/4258
    - fix: https://github.com/openchoreo/openchoreo/pull/4259
    - web: https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3
    - web: https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3
    - web: https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2
notes:
    - fix: 'module merge error: could not merge versions of module github.com/openchoreo/openchoreo: invalid or non-canonical semver version (found TODO (earliest fixed "1.2.0", vuln range ">= 1.2.0-rc.1, < 1.2.0-rc.2"))'
source:
    id: GHSA-rh53-xvx2-j327
    created: 2026-09-04T22:02:00.658715998Z
review_status: UNREVIEWED