Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-113727OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

High 7.4

In plain English

A high-severity authorization bypass via user-controlled key in openchoreo from openchoreo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.5%top 59.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/openchoreo/openchoreo1.0.6GHSA-46r4-q7wv-32fc
Gogithub.com/openchoreo/openchoreo1.1.7GHSA-46r4-q7wv-32fc
Gogithub.com/openchoreo/openchoreo1.2.5GHSA-46r4-q7wv-32fc
Gogithub.com/openchoreo/openchoreo1.0.6, 1.1.7, 1.2.5GO-2026-6825

Affected products (as reported)

VendorProductVersions
openchoreo openchoreo >= 1.0.0, < 1.0.6>= 1.1.0, < 1.1.7>= 1.2.0, < 1.2.5

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References