Summary
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
The OpenChoreo API server authorized PUT .../workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.
A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update check read those labels from the submitted object rather than the stored one, a caller holding workflowrun:update on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels.
The namespace is taken from the URL and feeds both the authorization check and the Kubernetes read, so it cannot diverge. This is cross-project and cross-component escalation inside a single namespace, not a cross-tenant issue.
Workarounds
If you cannot upgrade immediately, restrict who holds workflowrun:update.
Audit your AuthzRole and ClusterAuthzRole definitions for that action and remove it from any role granted to principals you would not trust with write access to every workflow run in the namespace. Among the roles shipped with OpenChoreo, only the system role workload-publisher lists workflowrun:update explicitly, and admin holds it through its * wildcard. Custom roles in your own values file may also include it, so check those.
Treat any credential bound to workload-publisher as privileged. CI systems are the usual holder, and a leaked CI token is enough to run this.
Impact
Rewriting the ownership labels transfers authority over the run. Every other WorkflowRun check (view, logs, events, status, delete, list) derives its scope from the stored labels, so once the write lands the policy engine legitimately grants the attacker access to an object they never had rights to. They can then:
- Read the victim's build logs. These stream raw pod logs from the workflow plane and routinely carry source paths, registry destinations, and credentials a build step echoed by accident.
- Read the run's Kubernetes events.
- Delete the run.
So the primary impact is confidentiality and availability, not only integrity. On the integrity side, spec.workflow.parameters can be overwritten on a pending run, and manipulating the two ownership labels can either wedge the run in a permanent ComponentValidationFailed condition or downgrade it to a standalone run that skips component validation.
Exploitation requires an authenticated caller with an AuthzRoleBinding or ClusterAuthzRoleBinding granting workflowrun:update at project or component scope in the victim's namespace, plus knowledge of the target run's name. An anonymous caller cannot reach this.
CVE-2026-113727 has a CVSS score of 7.4 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.6, 1.1.7, 1.2.5); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The authorization check now loads the stored WorkflowRun and derives every ownership attribute from it instead of from the request body. Separately, the openchoreo.dev/project and openchoreo.dev/component labels are now immutable on update, so an authorized caller cannot hand their own run to another project either.
| Line | Affected | Fixed in |
|---|---|---|
| 1.0.x | 1.0.0 through 1.0.5 | 1.0.6 |
| 1.1.x | 1.1.0 through 1.1.6 | 1.1.7 |
| 1.2.x | 1.2.0 through 1.2.4 | 1.2.5 |
Upgrade to the patched release on your line. No configuration change is needed after upgrading.
Frequently Asked Questions
- What is CVE-2026-113727? CVE-2026-113727 is a high-severity security vulnerability in github.com/openchoreo/openchoreo (go), affecting versions >= 1.0.0, < 1.0.6. It is fixed in 1.0.6, 1.1.7, 1.2.5.
- How severe is CVE-2026-113727? CVE-2026-113727 has a CVSS score of 7.4 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/openchoreo/openchoreo are affected by CVE-2026-113727? github.com/openchoreo/openchoreo (go) versions >= 1.0.0, < 1.0.6 is affected.
- Is there a fix for CVE-2026-113727? Yes. CVE-2026-113727 is fixed in 1.0.6, 1.1.7, 1.2.5. Upgrade to this version or later.
- Is CVE-2026-113727 exploitable, and should I be worried? Whether CVE-2026-113727 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-113727 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-113727?
- Upgrade
github.com/openchoreo/openchoreoto 1.0.6 or later - Upgrade
github.com/openchoreo/openchoreoto 1.1.7 or later - Upgrade
github.com/openchoreo/openchoreoto 1.2.5 or later
- Upgrade