Oopenchoreo

Products

Exploited and recent CVEs

• CVE-2026-113727 High 7.4 OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs 0.5%
• CVE-2026-73843 Critical 9.6 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs 0.5%
• CVE-2026-73842 Critical 9.0 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation 0.3%
• CVE-2026-73841 High 8.8 OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints 0.8%
• CVE-2026-73840 Medium 5.3 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) 0.3%
• CVE-2026-73667 High 8.8 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods 0.9%
• CVE-2026-73666 High 8.2 OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete 0.7%