Critical OpenChoreo vulnerability allows unauthenticated data-plane access

According to the GitHub Security Advisory database, OpenChoreo versions prior to 1.0.2, 1.1.2, and 1.2.0 contained a critical vulnerability in the cluster-gateway management APIs. These APIs were served on the same externally published listener used for data-plane agent connections in multi-cluster topologies. The management APIs did not authenticate callers, enabling unauthorized parties to perform privileged data-plane operations, such as proxying Kubernetes APIs and executing commands inside workload pods. This could lead to full compromise of workloads, including data disclosure, tampering, and denial of service.

The issue is resolved in versions 1.0.2, 1.1.2, and 1.2.0 by separating the management APIs onto an internal listener that is not externally published. Upgrading to these versions is non-disruptive and does not require changes to data-plane agents or configurations beyond the standard chart upgrade. Operators should verify whether their deployment uses the multi-cluster topology with externally published cluster-gateways. If so, they must ensure the upgrade path aligns with their current version (e.g., 1.1.x to 1.1.2) and confirm that the external listener is no longer serving management APIs post-upgrade. For environments unable to upgrade immediately, restricting external gateway access to known data-plane source addresses via firewall or gateway allowlisting is recommended as a temporary mitigation.