CVE-2026-73840: OpenChoreo webhook signature bypass in autobuild endpoint

CVE-2026-73840 · Severity: medium · CVSS 5.3 · Published 2026-08-13

OpenChoreo is a platform for automating software builds and deployments from Git repositories. Its autobuild feature allows automatic triggering of component builds when code is pushed; webhooks from GitHub, GitLab, or Bitbucket authenticate these triggers using cryptographic signatures. A flaw allows an attacker to bypass this authentication by specifying which provider to use via a request header, causing the endpoint to skip signature validation. An attacker with network access to the endpoint can trigger unauthorized builds and potentially deploy malicious code without authentication.

Technologies: github.com/openchoreo/openchoreo (Go), OpenChoreo. Vendors: Go, OpenChoreo.

Quick answers

Is CVE-2026-73840 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73840 being exploited in the wild.
How severe is CVE-2026-73840?
Medium severity, with a CVSS score of 5.3, published 13 August 2026.
Which products and versions are affected?
github.com/openchoreo/openchoreo (Go) SEMVER:introduced=0,fixed=1.0.3, SEMVER:introduced=0,fixed=1.0.3,introduced=1.1.0,fixed=1.1.3,introduced=1.2.0-rc.1,fixed=1.2.0-rc.2; OpenChoreo < 1.0.3, >= 1.1.0 and < 1.1.3, >= 1.2.0-rc.1 and < 1.2.0-rc.2.
Is there a fix for CVE-2026-73840?
Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.3, 1.2.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73840 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-73840?
Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/openchoreo/openchoreo (Go): upgrade to 1.0.3, 1.2.0-rc.2 or later
    go get github.com/openchoreo/openchoreo@v1.2.0-rc.2

Technical details

The vulnerability combines two authentication flaws: (1) the autobuild webhook endpoint (POST /api/v1alpha1/autobuild) determines which git provider to authenticate against based on a client-supplied X-Event-Key header instead of the target component's configured provider, and (2) the Bitbucket provider implementation omits HMAC-SHA256 signature validation entirely. An attacker can set X-Event-Key to trigger Bitbucket provider logic, bypassing the signature checks that protect GitHub and GitLab webhooks. The attack requires network reachability to the endpoint and knowledge of a component's repository URL and branch, but no authentication. The triggered build executes an attacker-supplied commit SHA, and component lookup spans the entire cluster without tenant/namespace scoping. Patches enforce HMAC-SHA256 validation on all providers, reject missing secrets, and verify the authenticated provider matches the component's configured provider. Fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

Affected products

  • OpenChoreo OpenChoreo < 1.0.3, >= 1.1.0 and < 1.1.3, >= 1.2.0-rc.1 and < 1.2.0-rc.2

Identifiers

  • CVE-2026-73840
  • GHSA-c5f6-2rm9-2w8g
  • GO-2026-6360

Timeline

  • 2026-09-02: disclosed: Published on GitHub Advisory Database
  • 2026-09-02: patched: Fixed in 1.0.3, 1.1.3, and 1.2.0-rc.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.