Is CVE-2026-113727 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113727 being exploited in the wild.

How severe is CVE-2026-113727?

High severity, with a CVSS score of 7.4, published 20 October 2026.

Which products and versions are affected?

github.com/openchoreo/openchoreo (Go) >= 1.0.0, < 1.0.6, SEMVER:introduced=1.0.0,fixed=1.0.6, SEMVER:introduced=1.0.0,fixed=1.0.6,introduced=1.1.0,fixed=1.1.7,introduced=1.2.0,fixed=1.2.5; OpenChoreo 1.0.0 to 1.0.5, 1.1.0 to 1.1.6, 1.2.0 to 1.2.4.

Is there a fix for CVE-2026-113727?

Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.6, 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113727 attacked?

It is attacked over the network.

Am I affected by CVE-2026-113727?

Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113727: OpenChoreo authorization bypass in workflow run updates

Q: Is there a fix for CVE-2026-113727?

Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.6, 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-113727 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-113727?

Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113727 · Severity: high · CVSS 7.4 · Published 2026-10-20

OpenChoreo is a Kubernetes application platform where developers build and manage containerized workflows. An authenticated attacker with permissions to update workflow runs in one project or component can manipulate the request to take over runs in other projects or components within the same namespace, gaining unauthorized access to logs, events, and configuration, or sabotaging the workflow execution.

Technologies: github.com/openchoreo/openchoreo (Go), OpenChoreo. Vendors: Go, OpenChoreo.

Quick answers

Is CVE-2026-113727 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113727 being exploited in the wild.
How severe is CVE-2026-113727?: High severity, with a CVSS score of 7.4, published 20 October 2026.
Which products and versions are affected?: github.com/openchoreo/openchoreo (Go) >= 1.0.0, < 1.0.6, SEMVER:introduced=1.0.0,fixed=1.0.6, SEMVER:introduced=1.0.0,fixed=1.0.6,introduced=1.1.0,fixed=1.1.7,introduced=1.2.0,fixed=1.2.5; OpenChoreo 1.0.0 to 1.0.5, 1.1.0 to 1.1.6, 1.2.0 to 1.2.4.
Is there a fix for CVE-2026-113727?: Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.6, 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113727 attacked?: It is attacked over the network.
Am I affected by CVE-2026-113727?: Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openchoreo/openchoreo (Go): upgrade to 1.0.6, 1.2.5 or later
```
go get github.com/openchoreo/openchoreo@v1.2.5
```

Technical details

The PUT /workflowruns/{runName} endpoint authorizes requests based on ownership labels submitted in the request body rather than the stored labels of the target run. An authenticated attacker with workflowrun:update permission for one project or component in a namespace can specify arbitrary ownership labels in the request to match a run they do not own, then read/modify/delete it or corrupt its state. The flaw is scoped to a single namespace and requires prior authentication.

Affected products

OpenChoreo OpenChoreo 1.0.0 to 1.0.5, 1.1.0 to 1.1.6, 1.2.0 to 1.2.4

Identifiers

CVE-2026-113727
GHSA-46r4-q7wv-32fc
GO-2026-6825

Timeline

2026-09-01: patched
2026-10-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.