OpenChoreo cluster-gateway: unauthenticated management API exposes data-plane Kubernetes API and pod exec

Impact

The cluster-gateway served its caller-facing management APIs on the externally reachable agent listener with no authentication, so anyone who can open a connection to that listener can call /api/proxy/ and /api/exec/. That means proxying the data-plane Kubernetes API and running commands inside workload pods on any managed cluster. In a multi-cluster fleet this collapses the boundary between the management plane and every tenant workload: an attacker reads secrets and service-account tokens mounted in pods, and gets a shell inside containers that may be holding GPU devices. Fixed in 1.0.2 and 1.1.2.

Who can reach it

Anyone with network reach to the cluster-gateway agent listener - adjacent network per the vendor vector (AV:A) - with no authentication and no prior account in the platform.

What to do

Upgrade OpenChoreo to 1.0.2 or 1.1.2 and restart the cluster-gateway deployment; no node drain or reboot is needed. Until the upgrade lands, restrict the agent listener to the control-plane network with a NetworkPolicy or firewall rule so it is not reachable from tenant or general datacenter networks.

References

Related entries

• Rancher: SAML assertion replay: the ACS handler does not enforce one-time use, so a captured assertion logsCVE-2026-44946 · RancherCritical
• Coolify: low-privileged member injects Docker Compose directives and gets root on the hostCVE-2025-59156 · Coolify (application deployment workflow, Docker Compose directives)Critical
• Kyverno: percent-encoded traversal in Policy apiCall urlPath escapes the namespace clamp to cluster adminCVE-2026-100706 · Kyverno admission controller (Policy apiCall urlPath namespace clamp)Critical
• Docker Hub: converting an account reassigned a PAT to another user without rotating the secretCVE-2026-105445 · Docker Hub (account-to-organization conversion, personal access tokens)Critical
• Kyverno: namespaced mutating policy can fabricate cross-namespace targets and overwrite cluster-wide resourcesCVE-2026-122303 · Kyverno (NamespacedMutatingPolicy mutate-existing targetMatchConstraints)Critical
• Kyverno: namespaced CleanupPolicy context entries run with the cleanup controller's ServiceAccountCVE-2026-122304 · Kyverno cleanup controller (CleanupPolicy context loader)Critical