CVE-2026-73840— OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Possible ATT&CK Techniques 3AI
T1059 · Command and Scripting Interpreter T1078 · Valid Accounts T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-73840
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Source: CVE Program / CVE List V5
Vulnerability Description
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| openchoreo | openchoreo | < 1.0.3 | - |
II. Public POCs for CVE-2026-73840
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73840
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-73840 (3)
Vendor Advisories for CVE-2026-73840 (1)
Vendor Pages for CVE-2026-73840 (2)
- 🔗 Release v1.1.3 · openchoreo/openchoreo · GitHubx_refsource_MISC
- 🔗 Release v1.0.3 · openchoreo/openchoreo · GitHubx_refsource_MISC
Same Patch Batch · openchoreo · 2026-08-13 · 6 CVEs total
| CVE-2026-73843 | 9.6 CRITICAL | OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway |
| CVE-2026-73842 | 9.0 CRITICAL | OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not re |
| CVE-2026-73667 | 8.8 HIGH | OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates ena |
| CVE-2026-73841 | 8.8 HIGH | OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo opencho |
| CVE-2026-73666 | 8.2 HIGH | OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data |
IV. Related Vulnerabilities
Same product: openchoreo
Same vendor: openchoreo
- CVE-2026-73843
OpenChoreo: Unauthenticated access to data-plane operations - CVE-2026-73842
OpenChoreo: cluster-gateway internal proxy performs no calle - CVE-2026-73841
OpenChoreo: Cross-project command execution and wirelog view - CVE-2026-73667
OpenChoreo: Authenticated OS command injection via OpenChore - CVE-2026-73666
OpenChoreo: Unauthenticated Backstage developer-portal API e
Same weakness: CWE-287
- CVE-2026-73302
Budibase: OIDC SSO account takeover: incoming identity linke - CVE-2026-17075
IBM i is Affected By Multiple Vulnerabilities in Digital Cer - CVE-2026-17101
IBM i is Affected By Multiple Vulnerabilities in Navigator f - CVE-2026-17099
IBM i is Affected By Multiple Vulnerabilities in Navigator f - CVE-2026-73655
Trigger.dev: Account Takeover via Cross-Provider OAuth Email
V. Comments for CVE-2026-73840
No comments yet