CVE-2026-73667

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73667
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73667.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73667
Aliases
  • GHSA-2mw5-23gm-pccq
Published
2026-08-13T21:43:43.895Z
Modified
2026-08-15T11:48:08.891660111Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Details

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73667.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/openchoreo/openchoreo

Affected ranges

Type
GIT
Repo
https://github.com/openchoreo/openchoreo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
98aa8742f7244e7150cc177438d83b9efc5fdece
Introduced
f2822307a9db82ee6f8f4f41b475252897b4f1a6
Fixed
fb2b659b9884eb45fa4f02b9cc7e89718a0276b7
Fixed
65c081ff74618714cb0c82b5d0e0fad2c2cbc46b
Fixed
eecc9de11c8f9fb189a2c1f6f2a1e12b7abbdd13
Fixed
017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9
Fixed
b274127a4342e5433c5035384cef57478b5b65ed
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.4"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "fixed": "1.1.4"
        },
        {
            "introduced": "1.2.0-rc.1"
        },
        {
            "fixed": "1.2.0-rc.2"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.16.0
v0.17.0
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v1.*
v1.0.0
v1.0.0-rc.1
v1.0.0-rc.2
v1.0.1
v1.0.1-hotfix.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73667.json"