Advisory [GHSA-qh9r-j7rp-4x2m](https://github.com/advisories/GHSA-qh9r-j7rp-4x2m) references a vulnerability in the following Go modules: | Module | | - | | [github.com/openchoreo/openchoreo](https://pkg.go.dev/github.com/openchoreo/openchoreo) | Description: ### Summary The OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the calling client. A party able to reach the listener could therefore invoke privileged data-plane operations without authenticating and without passing through the OpenChoreo API server's authorization. ### Impact An attacker who can reach the externally published cluster-gateway endpoint can perfor... References: - ADVISORY: https://github.com/advisories/GHSA-qh9r-j7rp-4x2m - ADVISORY: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m - ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2026-73843 - FIX: https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce - FIX: https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a - FIX: https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f - FIX: https://github.com/openchoreo/openchoreo/pull/4122 - WEB: https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2 - WEB: https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2 - WEB: https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0 No existing reports found with this module or alias. See [doc/quickstart.md](https://github.com/golang/vulndb/blob/master/doc/quickstart.md) for instructions on how to triage this report. ``` id: GO-ID-PENDING modules: - module: github.com/openchoreo/openchoreo versions: - fixed: 1.0.2 - introduced: 1.1.0 - fixed: 1.1.2 vulnerable_at: 1.1.1 summary: |- OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo cves: - CVE-2026-73843 ghsas: - GHSA-qh9r-j7rp-4x2m references: - advisory: https://github.com/advisories/GHSA-qh9r-j7rp-4x2m - advisory: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-73843 - fix: https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce - fix: https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a - fix: https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f - fix: https://github.com/openchoreo/openchoreo/pull/4122 - web: https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2 - web: https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2 - web: https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0 source: id: GHSA-qh9r-j7rp-4x2m created: 2026-09-03T00:02:14.806198495Z review_status: UNREVIEWED ```