# CVE-2026-113727: OpenChoreo authorization bypass in workflow run updates

Source: https://junglewise.ai/threats/cve-2026-113727-openchoreo-is-a-developer-platform-for-kubernetes-from-1-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113727 · Severity: high · CVSS 7.4 · Published 2026-10-20

OpenChoreo is a Kubernetes application platform where developers build and manage containerized workflows. An authenticated attacker with permissions to update workflow runs in one project or component can manipulate the request to take over runs in other projects or components within the same namespace, gaining unauthorized access to logs, events, and configuration, or sabotaging the workflow execution.

Technologies: [github.com/openchoreo/openchoreo (Go)](https://junglewise.ai/threats/technologies/github-com-openchoreo-openchoreo), [OpenChoreo](https://junglewise.ai/threats/technologies/openchoreo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenChoreo](https://junglewise.ai/threats/vendors/openchoreo).

## Quick answers

**Is CVE-2026-113727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113727 being exploited in the wild.

**How severe is CVE-2026-113727?** High severity, with a CVSS score of 7.4, published 20 October 2026.

**Which products and versions are affected?** github.com/openchoreo/openchoreo (Go) >= 1.0.0, < 1.0.6, SEMVER:introduced=1.0.0,fixed=1.0.6, SEMVER:introduced=1.0.0,fixed=1.0.6,introduced=1.1.0,fixed=1.1.7,introduced=1.2.0,fixed=1.2.5; OpenChoreo 1.0.0 to 1.0.5, 1.1.0 to 1.1.6, 1.2.0 to 1.2.4.

**Is there a fix for CVE-2026-113727?** Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.6, 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113727 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-113727?** Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openchoreo/openchoreo (Go): upgrade to 1.0.6, 1.2.5 or later

  ```sh
  go get github.com/openchoreo/openchoreo@v1.2.5
  ```


## Technical details

The PUT /workflowruns/{runName} endpoint authorizes requests based on ownership labels submitted in the request body rather than the stored labels of the target run. An authenticated attacker with workflowrun:update permission for one project or component in a namespace can specify arbitrary ownership labels in the request to match a run they do not own, then read/modify/delete it or corrupt its state. The flaw is scoped to a single namespace and requires prior authentication.

## Affected products

- OpenChoreo OpenChoreo 1.0.0 to 1.0.5, 1.1.0 to 1.1.6, 1.2.0 to 1.2.4

## Identifiers

- CVE-2026-113727
- GHSA-46r4-q7wv-32fc
- GO-2026-6825

## Timeline

- 2026-09-01: patched
- 2026-10-20: advisory

## References

- [https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca](https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca)
- [https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb](https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb)

## Related threats

- [OpenChoreo cluster-gateway authentication bypass](https://junglewise.ai/threats/cve-2026-73843-openchoreo-cluster-gateway-authentication-bypass)
- [OpenChoreo cluster-gateway missing authentication and authorization in internal proxy](https://junglewise.ai/threats/cve-2026-73842-openchoreo-cluster-gateway-missing-authentication-and)
- [OpenChoreo openchoreo-api authorization bypass in exec and wirelogs endpoints](https://junglewise.ai/threats/cve-2026-73841-openchoreo-openchoreo-api-authorization-bypass-in-exec-and)
- [OpenChoreo webhook signature bypass in autobuild endpoint](https://junglewise.ai/threats/cve-2026-73840-openchoreo-webhook-signature-bypass-in-autobuild-endpoint)
- [OpenChoreo OS command injection in Workflow Plane templates](https://junglewise.ai/threats/cve-2026-73667-openchoreo-os-command-injection-in-workflow-plane-templates)