What happened
NVD published CVE-2026-73843 (CVSS 9.6, Critical) on 2026-08-13, describing an unauthenticated exposure of internal management APIs on OpenChoreo's externally reachable agent listener for its Kubernetes-based developer platform.
Why it matters
OpenChoreo underpins Kubernetes-based platform infrastructure that can host AI agent workloads; unauthenticated access to cluster management/proxy APIs allows attackers to pivot into internal cluster resources.
Attack vector
internal/cluster-gateway/server.go serves caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and other management endpoints
Affected systems
OpenChoreo < 1.0.2, < 1.1.2
Mitigation
Upgrade to OpenChoreo 1.0.2 / 1.1.2 or later