CVE-2026-73667 – OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

Immediately identify all instances of the Acme Network Service Daemon (ANSD) version 3.x deployed across your infrastructure. This vulnerability specifically targets the HTTP/2 request parsing module within this version.

If possible and business operations allow, isolate affected systems from external network access by blocking inbound connections to the ANSD listening port (commonly TCP 8443 or 443).

If isolation is not feasible, consider temporarily disabling the ANSD service on critical systems until a patch can be applied. This will disrupt service but prevent exploitation.

Review system logs, ANSD specific logs, and network traffic logs for any signs of suspicious activity, such as unexpected process creation, unusual outbound network connections from ANSD, or file modifications in the ANSD installation directory or system directories.

Prepare for an emergency patching cycle. Ensure you have a rollback plan in case of issues with the patch.

2. PATCH AND UPDATE INFORMATION

Acme Corporation has released an emergency security update to address CVE-2026-73667. The patched version is Acme Network Service Daemon (ANSD) version 3.2.1.

Download the official patch or updated installer for ANSD 3.2.1 directly from the official Acme support portal or your authorized vendor channel. Do not download from unofficial sources.

Prioritize patching of internet-facing and critical internal ANSD instances.

Before deploying to production, thoroughly test the patch in a non-production environment to ensure compatibility and stability with your existing configurations and dependent applications.

Apply the patch by following Acme's official installation instructions. This typically involves stopping the ANSD service, applying the update, and then restarting the service.

After patching, verify that the ANSD service has restarted successfully and is operating as expected. Confirm the version number reflects 3.2.1.

3. MITIGATION STRATEGIES

If immediate patching is not possible, implement the following mitigation strategies:

Implement strict network access controls. Configure firewalls and Access Control Lists (ACLs) to restrict inbound access to the ANSD listening port (e.g., TCP 8443, 443) to only trusted internal networks or specific, authorized IP addresses. Minimize exposure to the public internet.

Deploy an Application Firewall (WAF) or API Gateway in front of your ANSD instances. Configure the WAF/API Gateway to inspect HTTP/2 traffic and specifically look for malformed HTTP/2 header frames, particularly oversized or unusually structured CONTINUATION frames, and block such requests.

If HTTP/2 functionality is not strictly required for your application, consider disabling HTTP/2 support within the ANSD configuration, forcing clients to use HTTP/1.1. Consult Acme's documentation for instructions on how to configure this. Note that this may impact performance for some clients.

Run the ANSD service with the principle of least privilege. Ensure the service account used by ANSD has only the minimum necessary permissions to function. Avoid running ANSD as root or SYSTEM if possible. Implement sandboxing or chroot environments where feasible to limit the impact of a successful exploit.

4. DETECTION METHODS

Implement and configure robust detection mechanisms to identify potential exploitation attempts or successful compromises:

Network Intrusion Detection/Prevention Systems (NIDS/NIPS): Configure NIDS/NIPS to monitor network traffic for unusual HTTP/2 patterns directed