CVE-2026-73666 - OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete

Back Back to CVE browser

HIGH

OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete

Published Aug 13, 2026

8.2

HIGH

CVSS 3.1

EPSS 0.68%

Description

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/* without authentication and allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion. This issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.

Affected products

Vendor Openchoreo Product Backstage-Plugins Default
n/a
- Version
  < 1.0.4
  Status
  affected
  Constraints
  -
- Version
  >= 1.1.0, < 1.1.4
  Status
  affected
  Constraints
  -
- Version
  >= 1.2.0-rc.1, < 1.2.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Openchoreo

Backstage-Plugins

n/a

Version	Status	Constraints
< 1.0.4	affected	-
>= 1.1.0, < 1.1.4	affected	-
>= 1.2.0-rc.1, < 1.2.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (12)

https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/pull/709
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/pull/712
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/pull/713
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/pull/716
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4
x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1
x_refsource_MISC
https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh
x_refsource_CONFIRM

Link	Providers	Tags
https://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/pull/709		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/pull/712		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/pull/713		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/pull/716		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4		x_refsource_MISC
https://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1		x_refsource_MISC
https://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvh		x_refsource_CONFIRM