CVE-2026-73840

Received Received - Intake

Unauthenticated Build Trigger in OpenChoreo

Publication date: 2026-08-13

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-14

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-73840

Affected Vendors & Products

Vendor	Product	Version / Range
openchoreo	openchoreo	to 1.2.0-rc.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

OpenChoreo versions before 1.0.3, 1.1.3, and 1.2.0-rc.2 had a flaw in the POST /api/v1alpha1/autobuild endpoint. It allowed attackers to trigger unauthorized builds by manipulating the X-Event-Key header and repository URL. The system failed to properly validate Bitbucket webhook requests, accepting them without HMAC-SHA256 signatures or a configured secret.

Detection Guidance

This vulnerability involves unauthenticated build triggers via the POST /api/v1alpha1/autobuild endpoint. To detect it, monitor network traffic for unauthorized POST requests to this endpoint. Check logs for unusual build triggers, especially from unrecognized sources or cross-provider requests. Verify if the X-Event-Key header is being used to select webhook providers without proper authentication.

Impact Analysis

An attacker could exploit this to trigger builds for any component, including cross-provider builds using fake commit SHAs. This could lead to unauthorized code execution, resource consumption, or disruption of CI/CD pipelines. The impact is limited to availability (denial of service) as per CVSS score.

Compliance Impact

This vulnerability allows unauthenticated build triggers and cross-provider manipulation via attacker-supplied commit SHAs, which could lead to unauthorized code execution or data access. This may violate compliance requirements for GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive repositories or builds.

Mitigation Strategies

Upgrade OpenChoreo to versions 1.0.3, 1.1.3, or 1.2.0-rc.2 or later to address the vulnerability in the POST /api/v1alpha1/autobuild endpoint.

Hi! I’m here to help you understand CVE-2026-73840. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70