CyberRota Analysis
AI-GeneratedKubernetes versions prior to 1.0.2 and 1.1.2 are vulnerable due to a lack of authentication for management APIs exposed on the external agent listener, enabling attackers to execute commands in workload pods and access the data-plane Kubernetes API. This critical vulnerability poses a significant risk to multi-cluster deployments, as it allows unauthorized network access to sensitive operations. Organizations using affected versions should prioritize immediate upgrades to the patched versions to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.