CVE-2026-73666CWE-306

CVE-2026-73666

High · published August 14, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00675 · 51.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-14T02:17Z
References (12)
https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07 · [email protected]https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501 · [email protected]https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474 · [email protected]https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52 · [email protected]https://github.com/openchoreo/backstage-plugins/pull/709 · [email protected]https://github.com/openchoreo/backstage-plugins/pull/712 · [email protected]https://github.com/openchoreo/backstage-plugins/pull/713 · [email protected]https://github.com/openchoreo/backstage-plugins/pull/716 · [email protected]https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4 · [email protected]https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4 · [email protected]https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1 · [email protected]https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh · [email protected]
EPSS history
Timeline
  • 13 AUG 21:40Z
    OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete
    cvelistv5