Executive brief
OpenChoreo is a platform for automating software builds and deployments from Git repositories. Its autobuild feature allows automatic triggering of component builds when code is pushed; webhooks from GitHub, GitLab, or Bitbucket authenticate these triggers using cryptographic signatures. A flaw allows an attacker to bypass this authentication by specifying which provider to use via a request header, causing the endpoint to skip signature validation. An attacker with network access to the endpoint can trigger unauthorized builds and potentially deploy malicious code without authentication.
Technical details
The vulnerability combines two authentication flaws: (1) the autobuild webhook endpoint (POST /api/v1alpha1/autobuild) determines which git provider to authenticate against based on a client-supplied X-Event-Key header instead of the target component's configured provider, and (2) the Bitbucket provider implementation omits HMAC-SHA256 signature validation entirely. An attacker can set X-Event-Key to trigger Bitbucket provider logic, bypassing the signature checks that protect GitHub and GitLab webhooks. The attack requires network reachability to the endpoint and knowledge of a component's repository URL and branch, but no authentication. The triggered build executes an attacker-supplied commit SHA, and component lookup spans the entire cluster without tenant/namespace scoping. Patches enforce HMAC-SHA256 validation on all providers, reject missing secrets, and verify the authenticated provider matches the component's configured provider. Fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Affected products
- OpenChoreo OpenChoreo < 1.0.3, >= 1.1.0 and < 1.1.3, >= 1.2.0-rc.1 and < 1.2.0-rc.2
Timeline
- 2026-09-02: disclosed: Published on GitHub Advisory Database
- 2026-09-02: patched: Fixed in 1.0.3, 1.1.3, and 1.2.0-rc.2