OpenChoreo API flaw enables cross-project command execution

According to the GitHub Security Advisory database, OpenChoreo versions prior to 1.2.3 and 1.1.6 contained a high-severity vulnerability in the `openchoreo-api` server. The flaw allowed authenticated users with project-scoped `component:exec` or `wirelogs:view` grants to access components owned by other projects within the same namespace. Authorization checks were performed against the caller-supplied project hierarchy rather than the actual owning project of the target component, enabling cross-project command execution and wirelog access. This exposed sensitive data such as environment variables and mounted Secrets, and allowed tampering with workloads and further network-based pivoting.

Operators planning to upgrade should verify whether their namespaces host multiple projects with shared components, as this vulnerability could have been exploited to compromise workloads across project boundaries. Additionally, ensure that all tenants with project-scoped grants are audited for unusual activity prior to the patch deployment. This issue highlights the importance of aligning authorization checks with resource ownership, a pattern increasingly adopted across projects to prevent privilege escalation within shared namespaces.