CVE-2026-73666

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73666
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73666.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73666
Aliases
  • GHSA-v7qx-mqhq-grvh
Published
2026-08-13T21:40:13.597Z
Modified
2026-08-16T03:31:24.144172983Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete
Details

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.

Database specific 
{
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73666.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/openchoreo/backstage-plugins

Affected ranges

Type
GIT
Repo
https://github.com/openchoreo/backstage-plugins
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
0346616c3a41175fe5647a3da7462b7b659a4d5f
Introduced
33abf75137b4662051259596b12ceb51ed20f506
Fixed
f61957e261df28352e083f50c4cb2a3be1f0dba5
Fixed
b0a4247b097388c967d4d1473e495e3fa314eaaa
Fixed
294f19462f41d9e4f2fd71b7c64eef5977136da1
Fixed
114a215689924b917da5fd28c56e679aaccaef07
Fixed
dfa3fc8bd1ffef1346442c891e3e3dd54bc26501
Fixed
f6df89c15834506902b2f706a9e8fbe1f6ef1474
Fixed
fdaceeb737938e830c48a150d5bec24f5f487e52
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.4"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "fixed": "1.1.4"
        },
        {
            "introduced": "1.2.0-rc.1"
        },
        {
            "fixed": "1.2.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.0-rc.1
v1.0.0-rc.2
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.0-rc.1
v1.2.0-rc.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73666.json"