High
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Type: advisorySources: OSV
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-73667
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 01:15 UTC · Revision 1
Source evidence
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
core-osv · Original sourcePublished 13 Aug 2026, 21:43 UTC
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.
osv:CVE-2026-73667
Complete source record
{
"id": "70b225a73d9065d508fdc9b4bd5961cd955fd6289d48641e69994d83182060fc",
"url": "https://osv.dev/vulnerability/CVE-2026-73667",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods",
"summary": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow pods while affected privileged Podman templates lacked hostUsers: false. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.0-rc.2.",
"evidence": "osv:CVE-2026-73667",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-73667",
"aliases": [
"CVE-2026-73667",
"GHSA-2mw5-23gm-pccq",
"GO-2026-6357"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openchoreo/openchoreo",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "fb2b659b9884eb45fa4f02b9cc7e89718a0276b7"
},
{
"introduced": "98aa8742f7244e7150cc177438d83b9efc5fdece"
},
{
"fixed": "65c081ff74618714cb0c82b5d0e0fad2c2cbc46b"
},
{
"introduced": "f2822307a9db82ee6f8f4f41b475252897b4f1a6"
},
{
"fixed": "eecc9de11c8f9fb189a2c1f6f2a1e12b7abbdd13"
},
{
"fixed": "017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9"
},
{
"fixed": "b274127a4342e5433c5035384cef57478b5b65ed"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.0.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "1.2.0-rc.1"
},
{
"fixed": "1.2.0-rc.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "65c081ff74618714cb0c82b5d0e0fad2c2cbc46b"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b274127a4342e5433c5035384cef57478b5b65ed"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "fb2b659b9884eb45fa4f02b9cc7e89718a0276b7"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "fb2b659b9884eb45fa4f02b9cc7e89718a0276b7"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.0.4"
},
{
"range": [
{
"fixed": "65c081ff74618714cb0c82b5d0e0fad2c2cbc46b"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.1.4"
},
{
"range": [
{
"fixed": "eecc9de11c8f9fb189a2c1f6f2a1e12b7abbdd13"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.2.0-rc.2"
}
]
}
}
],
"versions": [
"v1.0.3",
"v1.1.3",
"v1.0.2",
"v1.1.2",
"v1.1.1",
"v1.0.1",
"v1.1.0",
"v1.0.1-hotfix.1",
"v1.0.0",
"v1.0.0-rc.2",
"v1.0.0-rc.1",
"v0.17.0",
"v0.16.0",
"v0.14.0",
"v0.13.0",
"v0.12.0",
"v0.11.0",
"v0.10.0",
"v0.8.0",
"v0.7.0",
"v0.6.0",
"v0.4.0",
"v0.5.0",
"v0.3.0",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73667.json"
}
}
],
"modified": "2026-10-28T02:30:24.983125065Z",
"provider": "osv",
"references": [
"https://github.com/openchoreo/openchoreo/releases/tag/v1.0.4",
"https://github.com/openchoreo/openchoreo/releases/tag/v1.1.4",
"https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73667.json",
"https://github.com/openchoreo/openchoreo/security/advisories/GHSA-2mw5-23gm-pccq",
"https://nvd.nist.gov/vuln/detail/CVE-2026-73667",
"https://github.com/openchoreo/openchoreo/commit/017c3c6d8b27c21d11c8c2b43da1846aa7ae73b9",
"https://github.com/openchoreo/openchoreo/commit/65c081ff74618714cb0c82b5d0e0fad2c2cbc46b",
"https://github.com/openchoreo/openchoreo/commit/b274127a4342e5433c5035384cef57478b5b65ed",
"https://github.com/openchoreo/openchoreo/commit/fb2b659b9884eb45fa4f02b9cc7e89718a0276b7",
"https://github.com/openchoreo/openchoreo/pull/4193",
"https://github.com/openchoreo/openchoreo/pull/4243",
"https://github.com/openchoreo/openchoreo/pull/4277",
"https://github.com/openchoreo/openchoreo/pull/4297"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73667.json"
}
},
"related_cves": [
{
"value": "CVE-2026-73667",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491510,
"published_at": "2026-08-13T21:43:43.895+00:00"
}