CVE-2026-73667 - OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Brief
CVE ID : CVE-2026-73667
Published : Aug. 13, 2026, 10:17 p. m.
- 48 minutes ago
Description : OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.
- 4, 1.
- 4, and 1.
- 0-rc. 2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.
env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.
- 4, 1.
- 4, and 1.
- 0-rc.
- Severity: 8.8
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...