Unauthenticated Build Trigger in OpenChoreo

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73840

Affected Vendors & Products

Vendor	Product	Version / Range
openchoreo	openchoreo	to 1.2.0-rc.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

OpenChoreo versions before 1.0.3, 1.1.3, and 1.2.0-rc.2 had a flaw in the POST /api/v1alpha1/autobuild endpoint. It allowed attackers to trigger unauthorized builds by manipulating the X-Event-Key header and repository URL. The system failed to properly validate Bitbucket webhook requests, accepting them without HMAC-SHA256 signatures or a configured secret.

Impact Analysis

An attacker could exploit this to trigger builds for any component, including cross-provider builds using fake commit SHAs. This could lead to unauthorized code execution, resource consumption, or disruption of CI/CD pipelines. The impact is limited to availability (denial of service) as per CVSS score.

Mitigation Strategies

Upgrade OpenChoreo to versions 1.0.3, 1.1.3, or 1.2.0-rc.2 or later to address the vulnerability in the POST /api/v1alpha1/autobuild endpoint.

Hi! I’m here to help you understand CVE-2026-73840. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70