{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openchoreo-1.0.0-1.0.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openchoreo:openchoreo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-113727"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["openchoreo (1.0.0-1.0.5)","openchoreo (1.1.0-1.1.6)","openchoreo (1.2.0-1.2.4)"],"_cs_severities":["high"],"_cs_tags":["auth-bypass","privilege-escalation","webserver","kubernetes"],"_cs_type":"advisory","_cs_vendors":["OpenChoreo"],"content_html":"\u003cp\u003eOpenChoreo contains an authorization bypass vulnerability (CVE-2026-113727) in the \u003ccode\u003ePUT .../workflowruns/{runName}\u003c/code\u003e endpoint. The API server incorrectly derives ownership metadata from the request body rather than the stored object when evaluating the \u003ccode\u003eworkflowrun:update\u003c/code\u003e permission. Because a WorkflowRun's project and component membership is defined by the \u003ccode\u003eopenchoreo.dev/project\u003c/code\u003e and \u003ccode\u003eopenchoreo.dev/component\u003c/code\u003e labels, an authenticated caller can manipulate these labels to reassign ownership of a WorkflowRun to a project or component they control. This results in unauthorized access to sensitive build data, logs, and parameters within the same namespace.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to escalate privileges within a namespace. Observed impact includes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUnauthorized access to build logs, which may contain source paths, registry destinations, and secrets.\u003c/li\u003e\n\u003cli\u003eAccess to Kubernetes event streams for hijacked runs.\u003c/li\u003e\n\u003cli\u003eAbility to delete arbitrary WorkflowRuns.\u003c/li\u003e\n\u003cli\u003eModification of \u003ccode\u003espec.workflow.parameters\u003c/code\u003e on pending runs.\u003c/li\u003e\n\u003cli\u003eDenial of service by wedging the run in a \u003ccode\u003eComponentValidationFailed\u003c/code\u003e state.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenChoreo to version 1.0.6 (for 1.0.x), 1.1.7 (for 1.1.x), or 1.2.5 (for 1.2.5). These versions enforce correct authorization checks by loading stored metadata and make ownership labels immutable on update.\u003c/li\u003e\n\u003cli\u003eAudit \u003ccode\u003eAuthzRole\u003c/code\u003e and \u003ccode\u003eClusterAuthzRole\u003c/code\u003e definitions to identify and restrict principals holding \u003ccode\u003eworkflowrun:update\u003c/code\u003e permissions.\u003c/li\u003e\n\u003cli\u003eTreat credentials associated with the \u003ccode\u003eworkload-publisher\u003c/code\u003e system role as high-value, as they carry the necessary permissions for this exploit.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T17:06:39Z","date_published":"2026-10-21T17:06:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-openchoreo-auth-bypass/","summary":"OpenChoreo API server allows authenticated users with workflow update permissions to hijack ownership of cross-project WorkflowRuns, leading to unauthorized access to logs, build credentials, and workflow modification.","title":"OpenChoreo: WorkflowRun authorization bypass (CVE-2026-113727)","url":"https://feed.craftedsignal.io/briefs/2026-10-openchoreo-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Openchoreo (1.0.0-1.0.5)","version":"https://jsonfeed.org/version/1.1"}