# CVE-2026-73840: OpenChoreo webhook signature bypass in autobuild endpoint

Source: https://junglewise.ai/threats/cve-2026-73840-openchoreo-webhook-signature-bypass-in-autobuild-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73840 · Severity: medium · CVSS 5.3 · Published 2026-08-13

OpenChoreo is a platform for automating software builds and deployments from Git repositories. Its autobuild feature allows automatic triggering of component builds when code is pushed; webhooks from GitHub, GitLab, or Bitbucket authenticate these triggers using cryptographic signatures. A flaw allows an attacker to bypass this authentication by specifying which provider to use via a request header, causing the endpoint to skip signature validation. An attacker with network access to the endpoint can trigger unauthorized builds and potentially deploy malicious code without authentication.

Technologies: [github.com/openchoreo/openchoreo (Go)](https://junglewise.ai/threats/technologies/github-com-openchoreo-openchoreo), [OpenChoreo](https://junglewise.ai/threats/technologies/openchoreo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OpenChoreo](https://junglewise.ai/threats/vendors/openchoreo).

## Quick answers

**Is CVE-2026-73840 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73840 being exploited in the wild.

**How severe is CVE-2026-73840?** Medium severity, with a CVSS score of 5.3, published 13 August 2026.

**Which products and versions are affected?** github.com/openchoreo/openchoreo (Go) SEMVER:introduced=0,fixed=1.0.3, SEMVER:introduced=0,fixed=1.0.3,introduced=1.1.0,fixed=1.1.3,introduced=1.2.0-rc.1,fixed=1.2.0-rc.2; OpenChoreo < 1.0.3, >= 1.1.0 and < 1.1.3, >= 1.2.0-rc.1 and < 1.2.0-rc.2.

**Is there a fix for CVE-2026-73840?** Yes. github.com/openchoreo/openchoreo (Go): upgrade to 1.0.3, 1.2.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73840 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-73840?** Check whether you run github.com/openchoreo/openchoreo (Go) or OpenChoreo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openchoreo/openchoreo (Go): upgrade to 1.0.3, 1.2.0-rc.2 or later

  ```sh
  go get github.com/openchoreo/openchoreo@v1.2.0-rc.2
  ```


## Technical details

The vulnerability combines two authentication flaws: (1) the autobuild webhook endpoint (POST /api/v1alpha1/autobuild) determines which git provider to authenticate against based on a client-supplied X-Event-Key header instead of the target component's configured provider, and (2) the Bitbucket provider implementation omits HMAC-SHA256 signature validation entirely. An attacker can set X-Event-Key to trigger Bitbucket provider logic, bypassing the signature checks that protect GitHub and GitLab webhooks. The attack requires network reachability to the endpoint and knowledge of a component's repository URL and branch, but no authentication. The triggered build executes an attacker-supplied commit SHA, and component lookup spans the entire cluster without tenant/namespace scoping. Patches enforce HMAC-SHA256 validation on all providers, reject missing secrets, and verify the authenticated provider matches the component's configured provider. Fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

## Affected products

- OpenChoreo OpenChoreo < 1.0.3, >= 1.1.0 and < 1.1.3, >= 1.2.0-rc.1 and < 1.2.0-rc.2

## Identifiers

- CVE-2026-73840
- GHSA-c5f6-2rm9-2w8g
- GO-2026-6360

## Timeline

- 2026-09-02: disclosed: Published on GitHub Advisory Database
- 2026-09-02: patched: Fixed in 1.0.3, 1.1.3, and 1.2.0-rc.2

## References

- [https://api.github.com/users/ihopenre-eng](https://api.github.com/users/ihopenre-eng)
- [https://github.com/ihopenre-eng](https://github.com/ihopenre-eng)
- [https://api.github.com/users/ihopenre-eng/gists%7B/gist_id%7D](https://api.github.com/users/ihopenre-eng/gists%7B/gist_id%7D)
- [https://api.github.com/users/ihopenre-eng/repos](https://api.github.com/users/ihopenre-eng/repos)
- [https://avatars.githubusercontent.com/u/247072151?v=4](https://avatars.githubusercontent.com/u/247072151?v=4)
- [https://api.github.com/users/ihopenre-eng/events%7B/privacy%7D](https://api.github.com/users/ihopenre-eng/events%7B/privacy%7D)

## Related threats

- [OpenChoreo authorization bypass in workflow run updates](https://junglewise.ai/threats/cve-2026-113727-openchoreo-is-a-developer-platform-for-kubernetes-from-1-0-0)
- [OpenChoreo cluster-gateway authentication bypass](https://junglewise.ai/threats/cve-2026-73843-openchoreo-cluster-gateway-authentication-bypass)
- [OpenChoreo cluster-gateway missing authentication and authorization in internal proxy](https://junglewise.ai/threats/cve-2026-73842-openchoreo-cluster-gateway-missing-authentication-and)
- [OpenChoreo openchoreo-api authorization bypass in exec and wirelogs endpoints](https://junglewise.ai/threats/cve-2026-73841-openchoreo-openchoreo-api-authorization-bypass-in-exec-and)
- [OpenChoreo OS command injection in Workflow Plane templates](https://junglewise.ai/threats/cve-2026-73667-openchoreo-os-command-injection-in-workflow-plane-templates)