CVE-2026-73666: OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenChoreoto a version that resolves this vulnerability.Fixed in 1.0.4 - Upgrade
Upgrade
OpenChoreoto a version that resolves this vulnerability.Fixed in 1.1.4 - Upgrade
Upgrade
OpenChoreoto a version that resolves this vulnerability.Fixed in 1.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73666?
The severity of CVE-2026-73666 is rated as high with a score of 8.2.
How do I fix CVE-2026-73666?
To fix CVE-2026-73666, update OpenChoreo to versions 1.0.4, 1.1.4, or 1.2.1 or later.
What are the risks associated with CVE-2026-73666?
CVE-2026-73666 poses risks such as exposing sensitive OpenChoreo catalog data and allowing unauthorized write/delete actions.
What systems are affected by CVE-2026-73666?
CVE-2026-73666 affects versions of the OpenChoreo software prior to 1.0.4, 1.1.4, and 1.2.1.
What kind of exposure does CVE-2026-73666 allow?
CVE-2026-73666 allows unauthenticated access to the OpenChoreo developer-portal API, exposing API endpoints without authentication.