AUGUST 14, 2026
Live Feed
Back to database
Case File

CVE-2026-73666

HIGH · CVSS 8.2 EPSS 0.48% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-13 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

OpenChoreo, a developer platform for Kubernetes, contains a vulnerability that allows unauthenticated access to sensitive API endpoints, enabling unauthorized catalog reads and modifications. This issue affects versions prior to 1.0.4, 1.1.4, and 1.2.1, and organizations using these versions should prioritize upgrading to mitigate the risk of data exposure and unauthorized actions within their Kubernetes environments.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-73666
Severity
HIGH
CVSS
8.2
EPSS
0.48%
Kubernetes

Original NVD Description

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.