Security Digest: September 3, 2026 - 6 Critical Vulnerabilities

Six high-impact vulnerabilities were disclosed today, including one critical OpenChoreo exposure that can lead to full workload compromise and multiple authentication and authorization bypasses that cross project or tenant boundaries. Two Mailpit flaws also enable remote denial of service through unbounded memory use.

· 8 min read

Executive Summary

Six high-impact vulnerabilities were disclosed today, including one critical OpenChoreo exposure that can lead to full workload compromise and multiple authentication and authorization bypasses that cross project or tenant boundaries. Two Mailpit flaws also enable remote denial of service through unbounded memory use. If you run OpenChoreo or Mailpit, patch or restrict exposure now.

Priority should go to externally reachable services first: the OpenChoreo cluster-gateway, workflow plane, and API server; then SeaweedFS filer JWT deployments; and finally Mailpit instances exposed on the network. Where you cannot upgrade immediately, lock down access to trusted sources only.

Critical Vulnerabilities

CVE-2026-73843: OpenChoreo cluster-gateway auth bypass on exposed listener

  • Impact: An attacker who can reach the externally published cluster-gateway can invoke privileged data-plane operations without authentication, including proxying the Kubernetes API and executing commands inside workload pods. This can lead to full compromise of affected workloads.
  • Affected Systems: OpenChoreo multi-cluster / remote data-plane deployments running cluster-gateway versions before 1.0.2, 1.1.2, or 1.2.0.
  • Immediate Action: Upgrade immediately to the fixed release for your line. If you cannot upgrade today, restrict the external gateway endpoint to known data-plane source addresses only.
  • Mitigation: Apply 1.0.2, 1.1.2, or 1.2.0. No agent or configuration changes are required beyond the standard chart upgrade.

CVE-2026-73667: OpenChoreo workflow template command injection

  • Impact: Authenticated users who can configure or trigger affected workflows can execute arbitrary commands inside workflow pods. In some privileged Podman configurations, this can expose host-level risk.
  • Affected Systems: OpenChoreo Workflow Plane templates prior to 1.0.4, 1.1.4, and 1.2.0-rc.2.
  • Immediate Action: Patch now and review all custom workflow templates for unsafe shell interpolation. Limit workflow creation and triggering to trusted users only until patched.
  • Mitigation: Upgrade to the fixed releases and replace sample templates from the corrected release branches. Custom templates must be updated manually.

CVE-2026-73841: OpenChoreo cross-project exec and wirelogs authorization bypass

  • Impact: A tenant with a project-scoped exec or log-view grant on one project can run commands in, and read wirelogs from, components owned by other projects in the same namespace.
  • Affected Systems: OpenChoreo API server openchoreo-api before 1.1.6 and 1.2.3.
  • Immediate Action: Upgrade immediately. Until then, restrict component:exec and wirelogs:view grants to trusted operators only.
  • Mitigation: Apply 1.1.6 or 1.2.3. For stronger isolation, separate sensitive components into their own namespaces.

CVE-2026-72921: SeaweedFS filer JWT prefix authorization bypass

  • Impact: Tokens scoped to one path prefix can incorrectly access sibling paths with the same string prefix, enabling cross-tenant reads and writes.
  • Affected Systems: SeaweedFS filer deployments using allowed_prefixes before 4.24.
  • Immediate Action: Upgrade to 4.24 now. Recheck any tenant path design that relies on overlapping prefixes.
  • Mitigation: Update to 4.24. As a short-term reduction, avoid prefix names that are string-prefixes of one another.

CVE-2026-67445: Mailpit SMTP command-line memory exhaustion

  • Impact: A remote SMTP client can send an oversized command line and force Mailpit to allocate attacker-controlled memory before parsing, causing process slowdown or denial of service.
  • Affected Systems: Mailpit current develop and release v1.30.3; no fixed version identified in the advisory.
  • Immediate Action: Restrict SMTP exposure now. If Mailpit must stay online, bind SMTP only to trusted loopback or firewall-allowlisted sources.
  • Mitigation: No vendor fix was identified. Treat this as an operational hardening issue until a patched release is available.

CVE-2026-67446: Mailpit thumbnail endpoint image decode amplification DoS

  • Impact: An attacker can store a compact image attachment and trigger expensive server-side decoding work by requesting a thumbnail, creating memory and CPU pressure that can deny service.
  • Affected Systems: Mailpit current develop and release v1.30.3.
  • Immediate Action: Limit access to the web API now, especially if users can submit messages or attachments. Watch for repeated thumbnail requests on image-heavy mailboxes.
  • Mitigation: No fixed version was identified. Reduce exposure and consider isolating Mailpit behind authentication and network controls.

What to Do Now

  1. Patch OpenChoreo first if you run any exposed multi-cluster, workflow, or API-plane components.
  2. Lock down Mailpit if it is network-reachable; assume unauthenticated abuse is possible on default deployments.
  3. Upgrade SeaweedFS filer if you use JWT allowed_prefixes for tenant isolation.
  4. Audit workflow templates and grants for unsafe shell interpolation and overly broad exec/log permissions.

Verification steps:

  • Confirm OpenChoreo versions with your deployment manifests or chart lockfiles and verify the cluster-gateway is not publicly reachable except where required.
  • Search workflow templates for direct shell interpolation of user-controlled parameters.
  • Check SeaweedFS JWT prefix sets for overlapping paths such as /tenant1 and /tenant1234.
  • Validate Mailpit network bindings and confirm SMTP/API ports are not exposed beyond trusted clients.

Monitoring recommendations:

  • Alert on unusual exec activity, wirelog access, and Kubernetes API proxy use in OpenChoreo.
  • Watch for spikes in Mailpit SMTP command length, thumbnail requests, memory growth, and CPU saturation.
  • Review SeaweedFS access logs for cross-prefix token use and unexpected sibling-path access.

Related Resources

  • Internal blog posts: A digest page and incident response checklist should be published internally; link them here once available.
  • Official vendor advisories: OpenChoreo advisories for CVE-2026-73843, CVE-2026-73667, and CVE-2026-73841; SeaweedFS advisory for CVE-2026-72921; Mailpit security advisories and policy for CVE-2026-67445 and CVE-2026-67446.

Keep reading