OpenChoreo API Vulnerability: Cross-Project Access Risk
- Severity
- HIGH
- Affected component
- openchoreo-api (npm)
- Patched version
- 1.2.3, 1.1.6
An early warning has been issued for a critical vulnerability in the OpenChoreo API. This vulnerability, tracked as GHSA-52gf-6rpq-fgmx, allows authenticated users with project-scoped grants to execute commands and view logs of components in other projects within the same namespace.
What happened
The vulnerability arises from the OpenChoreo API server authorizing requests to its exec and wirelogs endpoints against the project supplied by the caller, rather than the actual owning project. This misconfiguration enables unauthorized cross-project access. The issue was first flagged on 2026-09-02T23:44:51+00:00 and is under investigation. Users of affected versions of the openchoreo-api npm package should assess their exposure by reviewing their current version and access control configurations.
Affected versions of the openchoreo-api npm package include those below 1.2.3 and 1.1.6. The recommended patched versions are 1.2.3 and 1.1.6. Users are advised to upgrade to one of these versions to mitigate the risk. Additionally, reviewing and tightening access controls for project-scoped grants is recommended to further secure the environment.
What to do about it
- Upgrade to OpenChoreo API version 1.2.3 or 1.1.6.
- Review and adjust access controls for project-scoped grants to ensure they are correctly configured.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation advice.
How 0Day would have caught this
openchoreo-api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of the openchoreo-api npm package below 1.2.3 or 1.1.6.
What should I do right now?
Upgrade to OpenChoreo API version 1.2.3 or 1.1.6 and review your access controls for project-scoped grants.
Is this vulnerability being exploited in the wild?
There is no confirmed evidence of this vulnerability being exploited in the wild at this time.
Where can I find more information about this vulnerability?
More information can be found in the primary source at https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx.