CVE-2026-113727
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In OpenChoreo from 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using project and component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update can rewrite ownership labels of another run in the same namespace, gaining access to logs, events, deletion, or parameter modification.
Risk Assessment
A low-privileged attacker can take control of workflow runs belonging to other projects in the same namespace, impacting data integrity and confidentiality.
Recommendation
Update OpenChoreo to version 1.0.6, 1.1.7, or 1.2.5 (or later) and restrict workflowrun:update permissions to trusted users.
Other vulnerabilities in OpenChoreo
See all- CVE-2026-73843Critical
OpenChoreo prior to 1.0.2 and 1.1.2 served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments.
- CVE-2026-73842Critical
OpenChoreo prior to 1.0.3, 1.1.3, and 1.2.0-rc.2 exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes.
- CVE-2026-73841High
OpenChoreo before versions 1.1.6 and 1.2.3 authorizes component:exec and wirelogs:view using the caller-supplied project query parameter instead of the component's owner project name. This allows a user with project-scoped grants to execute commands and read wirelogs from components owned by other projects in the same namespace.
- CVE-2026-73840Medium
OpenChoreo prior to versions 1.0.3, 1.1.3, and 1.2.0-rc.2 has a vulnerability in the POST /api/v1alpha1/autobuild endpoint. Webhook provider selection relies on attacker-controlled X-Event-Key, and Bitbucket requests are accepted without HMAC-SHA256 verification. This allows unauthenticated build triggers for components matched by repository URL and branch, including cross-provider attacks using attacker-supplied commit SHAs.
- CVE-2026-73667High
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.0-rc.2 has a vulnerability in Workflow Plane templates where developer-controlled parameters are interpolated into shell code executed via sh -c instead of being passed through container.env. This allows arbitrary commands to run in workflow pods, and affected privileged Podman templates lacked hostUsers: false.
- CVE-2026-73666High
OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.1 has a vulnerability in the Backstage backend where default authentication policy is hardcoded to be disabled and guest access is allowed outside development. This results in unauthenticated access to /api/*, allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion.
Original NVD description (English source)
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS