01 Record

CVE-2026-73667

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

HighPUBLISHEDCNA: GitHub_M

Base score8.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

02 Description

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

Published: 2026-08-13 21:43Z20 HR AGO
Last updated: 2026-08-13 21:44Z20 HR AGO
Reserved: 2026-08-13
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: High (CVSS 8.8)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-78
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: c849007b22b4790f3086735ce4ab92ad6bf33942cd74bf27110ea171d11c15b3

VendorProductVersionsPlatforms

openchoreoopenchoreo< 1.0.4, >= 1.1.0, < 1.1.4, >= 1.2.0-rc.1, < 1.2.0-rc.2—