OpenChoreo cluster-gateway Unauthenticated Access via Management APIs (CVE-2026-7343)

Vulnerability Overview Title: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs Description: The service of the OpenChoreo control plane exposes its management API, intended for callers, on the same network listener that accepts connections from data-plane agents. In a multi-cloud topology, this listener is exposed outside the cluster, and the management API performs no caller authentication. Consequently, reachable listeners allow invocation of privileged data-plane operations without going through OpenChoreo API server authentication. Scope Affected Versions: Fixed Versions: CVSS v3 Base Metrics: - Attack Vector: Adjacent - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High CVSS v3 Vector: CVE ID: Weaknesses: - CWE-306 - CWE-668 - CWE-862 Remediation Patch: Fixed in and . The fix moves the caller-facing management API to a separate internal listener that is not exposed outside the cluster, keeping only the agent connection endpoints on the externally reachable listener. The upgrade is non-disruptive—no data-plane or configuration changes are required beyond a standard patch upgrade. Upgrade paths: and . Workaround: If immediate upgrade is not possible: - For remote data planes, restrict accessibility of external gateway endpoints to known data-plane source addresses (allowlisting at the firewall/gateway level only). Additional Information Discloser: Mirage20 Publication Date: Jul 9 Severity: Critical (9.6 / 10) Credits: JanakaSandarawann

Goal Reached Thanks to every supporter — we hit 100%!

OpenChoreo cluster-gateway Unauthenticated Access via Management APIs (CVE-2026-7343)

More from this source