FKIE_CVE-2026-113727

Vulnerability from fkie_nvd - Published: 2026-10-20 22:19 - Updated: 2026-10-23 03:16
Severity
7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Summary
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.
References
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/pull/4596
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/pull/4618
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/pull/4626
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/pull/4627
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/releases/tag/v1.0.6
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/releases/tag/v1.1.7
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/releases/tag/v1.2.5
security-advisories@github.comhttps://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openchoreo",
          "vendor": "openchoreo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.0.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.1.0, \u003c 1.1.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.2.0, \u003c 1.2.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run\u0027s ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5."
    }
  ],
  "id": "CVE-2026-113727",
  "lastModified": "2026-10-23T03:16:31.367",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 3.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-113727",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-23T02:10:51.680790Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-20T22:19:29.570",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/pull/4596"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/pull/4618"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/pull/4626"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/pull/4627"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.