CVE-2026-73840

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

The OpenChoreo autobuild webhook endpoint (POST /api/v1alpha1/autobuild) selected the git provider used to authenticate an incoming webhook from a client-supplied request header rather than from the target component's configuration, and its Bitbucket provider accepted requests without a valid signature. A caller could set the X-Event-Key header to be treated as a Bitbucket webhook, bypassing the HMAC secret that otherwise protects GitHub and GitLab webhooks, and trigger a component build without authenticating.

An attacker who can reach the autobuild webhook endpoint and knows the repository URL and branch configured for an auto-build component can trigger a build for that component without authenticating, including components configured for GitHub or GitLab, since the provider used or verification is chosen by the caller rather than by the component's configuration. The
triggered build runs against a commit SHA supplied by the attacker, and the component lookup is not scoped to a tenant or namespace, so any auto-build component across the cluster matching the given repository and branch is affected. This can result in unauthorized builds, and, where auto-deploy is configured, unauthorized deployment of attacker-influenced code, and can be used to exhaust build resources through repeated unauthenticated triggering.

The exposure applies to any component with spec.autoBuild: true, regardless of which git provider it declares, wherever the autobuild webhook endpoint is network-reachable.

The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.

CVE-2026-73840 has a CVSS score of 5.3 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.0.3, 1.1.3, 1.2.0-rc.2); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Fixed in 1.0.3, 1.1.3, and 1.2.0-rc.2. The fix validates Bitbucket webhooks with HMAC-SHA256 against the configured secret using the same verification path as GitHub, requires a configured, non-empty secret for every provider (a missing secret now rejects the request instead of skipping validation), and requires the authenticated provider to match the git provider configured for the
matched component. Upgrading is non-disruptive, no component or webhook configuration changes are required beyond the standard upgrade. Upgrade path: 1.1.x → 1.1.3, 1.0.x and earlier → 1.0.3, 1.2 line → 1.2.0-rc.2 or later.

1. What is CVE-2026-73840? CVE-2026-73840 is a medium-severity improper authentication vulnerability in github.com/openchoreo/openchoreo (go), affecting versions < 1.0.3. It is fixed in 1.0.3, 1.1.3, 1.2.0-rc.2. The application does not adequately verify the identity of a user, device, or process before granting access.
2. How severe is CVE-2026-73840? CVE-2026-73840 has a CVSS score of 5.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/openchoreo/openchoreo are affected by CVE-2026-73840? github.com/openchoreo/openchoreo (go) versions < 1.0.3 is affected.
4. Is there a fix for CVE-2026-73840? Yes. CVE-2026-73840 is fixed in 1.0.3, 1.1.3, 1.2.0-rc.2. Upgrade to this version or later.
5. Is CVE-2026-73840 exploitable, and should I be worried? Whether CVE-2026-73840 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-73840 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-73840?
   • Upgrade github.com/openchoreo/openchoreo to 1.0.3 or later
   • Upgrade github.com/openchoreo/openchoreo to 1.1.3 or later
   • Upgrade github.com/openchoreo/openchoreo to 1.2.0-rc.2 or later

Other vulnerabilities in github.com/openchoreo/openchoreo