CVE-2026-73840 - OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Brief
CVE ID : CVE-2026-73840
Published : Aug. 13, 2026, 10:17 p. m.
- 48 minutes ago
Description : OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.
- 3, 1.
- 3, and 1.
- 0-rc. 2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.
go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.
- 3, 1.
- 3, and 1.
- 0-rc.
- Severity: 5.3
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...