OpenChoreo: workflow parameters interpolated into sh -c run as commands in privileged build pods

Impact

The Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-supplied workflow parameters directly into shell program text run through sh -c instead of passing them via container.env, so a developer who can trigger a build controls the command line. The affected privileged Podman templates also lacked hostUsers: false, meaning the injected command runs in a privileged pod sharing the host user namespace - the standard path from build-pipeline input to node-level access. On a shared cluster where the build plane and the GPU workload plane are the same nodes, or where the build pods hold registry push credentials, this turns "submit a build" into "run code as a privileged process on the node". Exposure depends on whether you actually deployed the sample templates; clusters using their own workflow templates need to check them for the same sh -c interpolation pattern.

Who can reach it

Authenticated developer-level access: anyone who can set workflow parameters and trigger a build in the OpenChoreo Workflow Plane. No cluster-admin rights and no direct node access needed.

What to do

Upgrade to OpenChoreo 1.0.4, 1.1.4 or 1.2.0-rc.2, then re-apply the shipped workflow templates - upgrading the controllers alone does not rewrite templates you already installed into the cluster, so restart/roll the workflow components and confirm the new templates pass parameters through container.env and set hostUsers: false. Audit any locally authored templates for the same pattern. Until the templates are replaced, restrict who can trigger builds and keep the Workflow Plane off nodes running tenant GPU workloads.

References

Related entries

• OpenChoreo API: project-scoped users can exec into and read wirelogs of other projects' componentsCVE-2026-73841 · OpenChoreo openchoreo-api (component exec and wirelogs handlers)High
• KubeEdge CloudCore: unauthenticated node task status reports let anyone falsify node upgrade resultsCVE-2026-82473 · KubeEdge CloudCore (CloudHub HTTPS server, node task status endpoints)High
• KubeVirt: Path traversal lets a user who can configure KubeVirt read arbitrary host filesCVE-2022-1798 · KubeVirtHigh
• BuildKit: Race between parallel build steps sharing cache mounts with subpathsCVE-2024-23651 · BuildKitHigh
• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High
• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh