NPM · SEPTEMBER 2026 · EARLY WARNING

OpenChoreo API Vulnerability: Cross-Project Command Execution Risk

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: openchoreo-api (npm)
Patched version: 1.2.3, 1.1.6

GHSA-52GF-6RPQ-FGMX

An early warning has been issued for a vulnerability in the OpenChoreo API that may allow authenticated users to execute commands and view wirelogs across different projects within the same namespace.

What happened

The OpenChoreo API reportedly authorized requests to its exec and wirelogs endpoints based on the project supplied by the caller rather than the actual project that owns the target component. This misconfiguration allowed an authenticated user with a project-scoped grant to potentially execute commands and access wirelogs of components owned by other projects in the same namespace.

This vulnerability is under investigation and has not been exploited in the wild according to current reports. The issue affects versions of the openchoreo-api prior to 1.2.3 and 1.1.6. Users are advised to review their access controls and upgrade to the patched versions as a precaution.

What to do about it

Upgrade to openchoreo-api version 1.2.3 or 1.1.6 to mitigate the risk.
Review and adjust access controls for project-scoped grants to ensure they are correctly configured.
Monitor the official sources for updates on this vulnerability and any further recommended actions.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If openchoreo-api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using a version of openchoreo-api prior to 1.2.3 or 1.1.6.

What should I do right now?

Upgrade to openchoreo-api version 1.2.3 or 1.1.6 and review your access controls for project-scoped grants.

Has this vulnerability been exploited in the wild?

There are no reports of this vulnerability being exploited in the wild at this time.

Sources

Join the 0Day waitlist →

← Back to all threats