OpenChoreo: WorkflowRun authorization bypass (CVE-2026-113727)

OpenChoreo contains an authorization bypass vulnerability (CVE-2026-113727) in the PUT .../workflowruns/{runName} endpoint. The API server incorrectly derives ownership metadata from the request body rather than the stored object when evaluating the workflowrun:update permission. Because a WorkflowRun's project and component membership is defined by the openchoreo.dev/project and openchoreo.dev/component labels, an authenticated caller can manipulate these labels to reassign ownership of a WorkflowRun to a project or component they control. This results in unauthorized access to sensitive build data, logs, and parameters within the same namespace.

Impact

Successful exploitation allows an attacker to escalate privileges within a namespace. Observed impact includes:

• Unauthorized access to build logs, which may contain source paths, registry destinations, and secrets.
• Access to Kubernetes event streams for hijacked runs.
• Ability to delete arbitrary WorkflowRuns.
• Modification of spec.workflow.parameters on pending runs.
• Denial of service by wedging the run in a ComponentValidationFailed state.

Recommendation

• Upgrade OpenChoreo to version 1.0.6 (for 1.0.x), 1.1.7 (for 1.1.x), or 1.2.5 (for 1.2.5). These versions enforce correct authorization checks by loading stored metadata and make ownership labels immutable on update.
• Audit AuthzRole and ClusterAuthzRole definitions to identify and restrict principals holding workflowrun:update permissions.
• Treat credentials associated with the workload-publisher system role as high-value, as they carry the necessary permissions for this exploit.