Vulnerability-Lookup

CVE-2026-113727 (GCVE-0-2026-113727)

Vulnerability from cvelistv5 – Published: 2026-10-20 21:08 – Updated: 2026-10-23 02:10

Title

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

Summary

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 02:10 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7664 records in the last 180 days details

References

12 references

URL	Tags
https://github.com/openchoreo/openchoreo/security…	x_refsource_CONFIRM
https://github.com/openchoreo/openchoreo/pull/4596	x_refsource_MISC
https://github.com/openchoreo/openchoreo/pull/4618	x_refsource_MISC
https://github.com/openchoreo/openchoreo/pull/4626	x_refsource_MISC
https://github.com/openchoreo/openchoreo/pull/4627	x_refsource_MISC
https://github.com/openchoreo/openchoreo/commit/0…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/commit/4…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/commit/9…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/commit/d…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/releases…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/releases…	x_refsource_MISC
https://github.com/openchoreo/openchoreo/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
openchoreo	openchoreo	Affected: >= 1.0.0, < 1.0.6 Affected: >= 1.1.0, < 1.1.7 Affected: >= 1.2.0, < 1.2.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113727",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T02:10:51.680790Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T02:10:59.280Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openchoreo",
          "vendor": "openchoreo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.0.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.1.0, \u003c 1.1.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.2.0, \u003c 1.2.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run\u0027s ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:08:37.372Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/pull/4596",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/pull/4596"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/pull/4618",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/pull/4618"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/pull/4626",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/pull/4626"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/pull/4627",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/pull/4627"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7"
        },
        {
          "name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"
        }
      ],
      "source": {
        "advisory": "GHSA-46r4-q7wv-32fc",
        "discovery": "UNKNOWN"
      },
      "title": "OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-113727",
    "datePublished": "2026-10-20T21:08:37.372Z",
    "dateReserved": "2026-10-20T16:03:14.863Z",
    "dateUpdated": "2026-10-23T02:10:59.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-113727",
      "date": "2026-10-22",
      "epss": "0.00434",
      "percentile": "0.36642"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "openchoreo",
                "vendor": "openchoreo",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.0.0, \u003c 1.0.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.1.0, \u003c 1.1.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.2.0, \u003c 1.2.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run\u0027s ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5."
          }
        ],
        "id": "CVE-2026-113727",
        "lastModified": "2026-10-23T03:16:31.367",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 3.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-113727",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T02:10:51.680790Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-20T22:19:29.570",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/pull/4596"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/pull/4618"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/pull/4626"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/pull/4627"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-113727",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-23T02:10:51.680790Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-23T02:10:55.864Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "openchoreo",
              "vendor": "openchoreo",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.0.0, \u003c 1.0.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.1.0, \u003c 1.1.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.2.0, \u003c 1.2.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run\u0027s ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-20T21:08:37.372Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/pull/4596",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/pull/4596"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/pull/4618",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/pull/4618"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/pull/4626",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/pull/4626"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/pull/4627",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/pull/4627"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7"
            },
            {
              "name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"
            }
          ],
          "source": {
            "advisory": "GHSA-46r4-q7wv-32fc",
            "discovery": "UNKNOWN"
          },
          "title": "OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-113727",
        "datePublished": "2026-10-20T21:08:37.372Z",
        "dateReserved": "2026-10-20T16:03:14.863Z",
        "dateUpdated": "2026-10-23T02:10:59.280Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-113727

Vulnerability from fkie_nvd - Published: 2026-10-20 22:19 - Updated: 2026-10-23 03:16

Severity

7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/pull/4596
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/pull/4618
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/pull/4626
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/pull/4627
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5
	security-advisories@github.com	https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openchoreo",
          "vendor": "openchoreo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.0.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.1.0, \u003c 1.1.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.2.0, \u003c 1.2.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run\u0027s ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5."
    }
  ],
  "id": "CVE-2026-113727",
  "lastModified": "2026-10-23T03:16:31.367",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 3.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-113727",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-23T02:10:51.680790Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-20T22:19:29.570",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/pull/4596"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/pull/4618"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/pull/4626"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/pull/4627"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-46R4-Q7WV-32FC

Vulnerability from github – Published: 2026-10-21 16:29 – Updated: 2026-10-21 16:29

Summary

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

Details

Summary

The OpenChoreo API server authorized PUT .../workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.

A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update check read those labels from the submitted object rather than the stored one, a caller holding workflowrun:update on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels.

The namespace is taken from the URL and feeds both the authorization check and the Kubernetes read, so it cannot diverge. This is cross-project and cross-component escalation inside a single namespace, not a cross-tenant issue.

Impact

Rewriting the ownership labels transfers authority over the run. Every other WorkflowRun check (view, logs, events, status, delete, list) derives its scope from the stored labels, so once the write lands the policy engine legitimately grants the attacker access to an object they never had rights to. They can then:

Read the victim's build logs. These stream raw pod logs from the workflow plane and routinely carry source paths, registry destinations, and credentials a build step echoed by accident.
Read the run's Kubernetes events.
Delete the run.

So the primary impact is confidentiality and availability, not only integrity. On the integrity side, spec.workflow.parameters can be overwritten on a pending run, and manipulating the two ownership labels can either wedge the run in a permanent ComponentValidationFailed condition or downgrade it to a standalone run that skips component validation.

Exploitation requires an authenticated caller with an AuthzRoleBinding or ClusterAuthzRoleBinding granting workflowrun:update at project or component scope in the victim's namespace, plus knowledge of the target run's name. An anonymous caller cannot reach this.

Patches

The authorization check now loads the stored WorkflowRun and derives every ownership attribute from it instead of from the request body. Separately, the openchoreo.dev/project and openchoreo.dev/component labels are now immutable on update, so an authorized caller cannot hand their own run to another project either.

Line	Affected	Fixed in
1.0.x	1.0.0 through 1.0.5	1.0.6
1.1.x	1.1.0 through 1.1.6	1.1.7
1.2.x	1.2.0 through 1.2.4	1.2.5

Upgrade to the patched release on your line. No configuration change is needed after upgrading.

Workarounds

If you cannot upgrade immediately, restrict who holds workflowrun:update.

Audit your AuthzRole and ClusterAuthzRole definitions for that action and remove it from any role granted to principals you would not trust with write access to every workflow run in the namespace. Among the roles shipped with OpenChoreo, only the system role workload-publisher lists workflowrun:update explicitly, and admin holds it through its * wildcard. Custom roles in your own values file may also include it, so check those.

Treat any credential bound to workload-publisher as privileged. CI systems are the usual holder, and a leaked CI token is enough to run this.

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openchoreo/openchoreo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openchoreo/openchoreo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.1.0"
            },
            {
              "fixed": "1.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openchoreo/openchoreo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0"
            },
            {
              "fixed": "1.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-113727"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-21T16:29:53Z",
    "nvd_published_at": "2026-10-20T22:19:29Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe OpenChoreo API server authorized `PUT .../workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.\n\nA `WorkflowRun`\u0027s membership in a project and component is carried entirely by its `openchoreo.dev/project` and `openchoreo.dev/component` labels. Because the `workflowrun:update` check read those labels from the submitted object rather than the stored one, a caller holding `workflowrun:update` on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels.\n\nThe namespace is taken from the URL and feeds both the authorization check and the Kubernetes read, so it cannot diverge. This is cross-project and cross-component escalation inside a single namespace, not a cross-tenant issue.\n\n## Impact\n\nRewriting the ownership labels transfers authority over the run. Every other WorkflowRun check (view, logs, events, status, delete, list) derives its scope from the stored labels, so once the write lands the policy engine legitimately grants the attacker access to an object they never had rights to. They can then:\n\n- Read the victim\u0027s build logs. These stream raw pod logs from the workflow plane and routinely carry source paths, registry destinations, and credentials a build step echoed by accident.\n- Read the run\u0027s Kubernetes events.\n- Delete the run.\n\nSo the primary impact is confidentiality and availability, not only integrity. On the integrity side, `spec.workflow.parameters` can be overwritten on a pending run, and manipulating the two ownership labels can either wedge the run in a permanent `ComponentValidationFailed` condition or downgrade it to a standalone run that skips component validation.\n\nExploitation requires an authenticated caller with an `AuthzRoleBinding` or `ClusterAuthzRoleBinding` granting `workflowrun:update` at project or component scope in the victim\u0027s namespace, plus knowledge of the target run\u0027s name. An anonymous caller cannot reach this.\n\n## Patches\n\nThe authorization check now loads the stored WorkflowRun and derives every ownership attribute from it instead of from the request body. Separately, the `openchoreo.dev/project` and `openchoreo.dev/component` labels are now immutable on update, so an authorized caller cannot hand their own run to another project either.\n\n| Line | Affected | Fixed in |\n|---|---|---|\n| 1.0.x | 1.0.0 through 1.0.5 | 1.0.6 |\n| 1.1.x | 1.1.0 through 1.1.6 | 1.1.7 |\n| 1.2.x | 1.2.0 through 1.2.4 | 1.2.5 |\n\nUpgrade to the patched release on your line. No configuration change is needed after upgrading.\n\n## Workarounds\n\nIf you cannot upgrade immediately, restrict who holds `workflowrun:update`.\n\nAudit your `AuthzRole` and `ClusterAuthzRole` definitions for that action and remove it from any role granted to principals you would not trust with write access to every workflow run in the namespace. Among the roles shipped with OpenChoreo, only the system role `workload-publisher` lists `workflowrun:update` explicitly, and `admin` holds it through its `*` wildcard. Custom roles in your own values file may also include it, so check those.\n\nTreat any credential bound to `workload-publisher` as privileged. CI systems are the usual holder, and a leaked CI token is enough to run this.",
  "id": "GHSA-46r4-q7wv-32fc",
  "modified": "2026-10-21T16:29:53Z",
  "published": "2026-10-21T16:29:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113727"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4596"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4618"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4626"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4627"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openchoreo/openchoreo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-113727 (GCVE-0-2026-113727)

FKIE_CVE-2026-113727

GHSA-46R4-Q7WV-32FC

Summary

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour