CVE-2026-113727

Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in OpenChoreo WorkflowRun Updates

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113727

Affected Vendors & Products

Vendor	Product	Version / Range
openchoreo	openchoreo	>= 1.0.0, < 1.0.6
openchoreo	openchoreo	>= 1.1.0, < 1.1.7
openchoreo	openchoreo	>= 1.2.0, < 1.2.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

OpenChoreo is a Kubernetes developer platform. This vulnerability allows an authenticated attacker with limited permissions to manipulate workflow run ownership labels by submitting malicious requests. The attacker can rewrite ownership labels of another user's workflow run within the same namespace, gaining unauthorized access to sensitive operations like reading logs, deleting runs, or modifying parameters.

Impact Analysis

If you use OpenChoreo versions between 1.0.0 and 1.0.6, 1.1.7, and 1.2.5, an attacker with workflowrun:update permissions could access your workflow runs, steal sensitive data from logs, delete critical workflows, or alter parameters. This could disrupt operations, cause data loss, or lead to unauthorized modifications in your Kubernetes environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's confidentiality rules. If exploited, it may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory obligations for data security and access controls.

Mitigation Strategies

Upgrade OpenChoreo to versions 1.0.6, 1.1.7, or 1.2.5 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-113727. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...