Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openchoreo/openchoreo | go | >= 1.2.0-m.1, < 1.2.3 | 1.2.3 |
| github.com/openchoreo/openchoreo | go | < 1.1.6 | 1.1.6 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-73841, describes an authorization bypass in OpenChoreo's exec and wirelogs endpoints. Specifically, it states that the internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go files were authorizing requests using a 'caller-supplied project query parameter' instead of the component's true owning project (comp.Spec.Owner.ProjectName).
Analysis of the provided commit 4d372eaf1f07525663dcca5257062f4b051b9820 (and its backports 9d77b64f747eba89247c47ebfeffec591c4cd2d8 and c9390e4fcb9953f43b07cb48197576182301593d) confirms this. In both exec.go and wirelogs.go:
project variable, previously directly taken from the request's query parameters, is renamed to requestedProject.resolveComponentProject, is introduced to fetch the actual comp.Spec.Owner.ProjectName for the targeted component.requestedProject with the ownerProject (obtained from resolveComponentProject). If they do not match, the request is denied with a http.StatusForbidden error.ownerProject derived from the component's specification, rather than the user-supplied value.Therefore, the ServeHTTP methods within both ExecHandler and WirelogsHandler were the points of vulnerability. Prior to the patch, these functions directly consumed and trusted the project parameter from the HTTP request for authorization, leading to the cross-project command execution and wirelog view access. The resolveComponentProject function itself is part of the fix, not the vulnerability, but its absence and the direct use of the query parameter in ServeHTTP made ServeHTTP vulnerable. These functions would appear in a runtime profiler when an attacker exploits this vulnerability by making requests to these endpoints with a manipulated project query parameter.
ExecHandler.ServeHTTPinternal/openchoreo-api/api/handlers/exec.go
WirelogsHandler.ServeHTTPinternal/openchoreo-api/api/handlers/wirelogs.go