Read the docs
TI-2026-78530 Aliases CVE-2026-113727GHSA-46r4-q7wv-32fc

OpenChoreo authorization bypass lets callers take over workflow runs

Priority LOW 33CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

OpenChoreo, a developer platform for Kubernetes, is affected from 1.0.0 before 1.0.6, from 1.1.0 before 1.1.7, and from 1.2.0 before 1.2.5. The workflow run update route checks authorization using project and component labels from the request body but loads the stored run by its URL path (CWE-639). An authenticated user with workflow run update rights in one project or component can rewrite another run's ownership labels in the same namespace and then read its build logs, delete it, or modify its pending parameters. The flaw is not reachable anonymously or across tenants.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed openchoreo (openchoreo): 1.0.6, 1.1.7, 1.2.5github.com/openchoreo/openchoreo (Go): 1.0.6, 1.1.7, 1.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openchoreoopenchoreo1.0.0 to before 1.0.6; 1.1.0 to before 1.1.7; 1.2.0 to before 1.2.51.0.6, 1.1.7, 1.2.5Patch availableCNA
—github.com/openchoreo/openchoreo (Go)1.0.0 to before 1.0.61.0.6Patch availableGHSA-46r4-q7wv-32fc
—github.com/openchoreo/openchoreo (Go)1.1.0 to before 1.1.71.1.7Patch availableGHSA-46r4-q7wv-32fc
—github.com/openchoreo/openchoreo (Go)1.2.0 to before 1.2.51.2.5Patch availableGHSA-46r4-q7wv-32fc
  • openchoreo Vendoropenchoreo Affected 1.0.0 to before 1.0.6; 1.1.0 to before 1.1.7; 1.2.0 to before 1.2.5 Fixed in 1.0.6, 1.1.7, 1.2.5 Patch available CNA
  • github.com/openchoreo/openchoreo (Go) Vendor— Affected 1.0.0 to before 1.0.6 Fixed in 1.0.6 Patch available GHSA-46r4-q7wv-32fc
  • github.com/openchoreo/openchoreo (Go) Vendor— Affected 1.1.0 to before 1.1.7 Fixed in 1.1.7 Patch available GHSA-46r4-q7wv-32fc
  • github.com/openchoreo/openchoreo (Go) Vendor— Affected 1.2.0 to before 1.2.5 Fixed in 1.2.5 Patch available GHSA-46r4-q7wv-32fc

Remediation

Upgrade the Go module github.com/openchoreo/openchoreo to 1.0.6, 1.1.7 or 1.2.5, matching your release branch. The sources list no fixed version for openchoreo.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA openchoreo (openchoreo) Fixed in 1.0.6, 1.1.7, 1.2.5
  • Fix · GHSA-46r4-q7wv-32fc github.com/openchoreo/openchoreo (Go) Fixed in 1.0.6 Advisory →
  • Fix · GHSA-46r4-q7wv-32fc github.com/openchoreo/openchoreo (Go) Fixed in 1.1.7 Advisory →
  • Fix · GHSA-46r4-q7wv-32fc github.com/openchoreo/openchoreo (Go) Fixed in 1.2.5 Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-113727
  2. 2026-10-21 Alias added: GHSA-46r4-q7wv-32fc
  3. 2026-10-21 Fix available: Go/github.com/openchoreo/[email protected], Go/github.com/openchoreo/[email protected], Go/github.com/openchoreo/[email protected] · GHSA-46r4-q7wv-32fc
  4. 2026-10-21 CVSS score added · GHSA-46r4-q7wv-32fc
  5. 2026-10-21 Weakness changed · GHSA-46r4-q7wv-32fc
  6. 2026-10-21 14 new references · GHSA-46r4-q7wv-32fc
  7. 2026-10-22 Priority changed: MEDIUM → LOW
  8. 2026-10-23 CISA SSVC decision points changed

References

Advisory 1

Other 13

  • TI-2026-51866 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs CVSS 3.1CRITICAL 9.6
  • TI-2026-51750 Missing authentication in openchoreo backstage-plugins CVSS 3.1HIGH 8.2
  • TI-2026-51864 Authorization bypass in openchoreo CVSS 3.1HIGH 8.8
  • TI-2026-51751 OS command injection in openchoreo CVSS 3.1HIGH 8.8
  • TI-2026-51865 Improper privilege management in openchoreo CVSS 3.1CRITICAL 9.0
  • TI-2026-51863 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences