CVE-2026-73843

The vulnerability in OpenChoreo's cluster-gateway agent listener (CVE-2026-73843, CVSS 9.6) stems from a structural failure in how Kubernetes development teams reason about network boundaries. The file lived under internal/cluster-gateway/server.go — a path that created a false sense of security through naming convention alone. In Go's module system, 'internal/' restricts package visibility at compile time, not network reachability. These are orthogonal concerns that got conflated during review, and no one validated whether the listener was actually unreachable from untrusted networks. The agent binary ships to customer-managed clusters, which means code written under assumptions about a control plane's deployment context executed in an entirely different trust domain. The artifact left the building without its threat model traveling with it. This is the critical gap: developers reviewed the code against their mental model of where it would run, but the binary deployed somewhere that model never described. The fix — a version bump to 1.0.2 or 1.1.2 adding authentication middleware — addresses the symptom, not the pattern. This vulnerability has genealogical siblings: the AWS metadata endpoint, service mesh management ports, and Kubernetes cloud controller APIs all suffered from the same category error — treating network topology as a security boundary. Each was patched with auth middleware, and each patch left the underlying assumption intact. For defenders: audit your multi-cluster tooling for listeners that assume reachability is zero based on naming conventions or directory structure. Model blast radius at design time — ask 'what happens if this path becomes reachable' before shipping. Treat 'internal/' as a code organization hint, not a security boundary. The most dangerous code is what you believe is unreachable.

Reviewed through automated stages and approved by a human before publication.