OpenChoreo cluster-gateway Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- openchoreo (go)
- Affected versions
- < 1.0.3 or >= 1.1.0, < 1.1.3 or >= 1.2.0-rc.1, < 1.2.0-rc.2
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in OpenChoreo cluster-gateway that reportedly allows unauthenticated access to Kubernetes APIs, potentially leading to secret disclosure and arbitrary Kubernetes mutation. Users of affected versions should review their configurations immediately.
What happened
An early warning has been issued regarding a vulnerability in the OpenChoreo cluster-gateway. The internal management APIs of the OpenChoreo control-plane cluster-gateway are exposed and do not require authentication. This exposure allows any party with access to the internal listener to read Secrets, create, modify, or delete workloads, and execute commands within pods. The vulnerability is tracked under GHSA-RH53-XVX2-J327 and GHSA-52GF-6RPQ-FGMX. It was first flagged on 2026-09-04T21:41:38+00:00.
The affected component is the openchoreo (go) package. Versions less than 1.0.3, between 1.1.0 and 1.1.3, and between 1.2.0-rc.1 and 1.2.0-rc.2 are reportedly vulnerable. Users of these versions should assess their exposure by reviewing their network configurations and access controls for the internal listener of the OpenChoreo cluster-gateway.
What to do about it
- Review and restrict network access to the internal listener of the OpenChoreo cluster-gateway.
- Implement additional authorization controls to mitigate the risk of unauthorized access.
- Monitor the primary sources for updates on patched versions and further mitigation advice.
How 0Day would have caught this
openchoreo is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using openchoreo (go) versions less than 1.0.3, between 1.1.0 and 1.1.3, or between 1.2.0-rc.1 and 1.2.0-rc.2.
What should I do right now?
Immediately review and restrict network access to the internal listener of the OpenChoreo cluster-gateway and implement additional authorization controls.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.