CVSS
8.2
CVSS v3.1
EPSS
N/A
Exploit Prediction Score
Published
August 13, 2026
Exploitability
No EPSS data available
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).