Security incident · CVE-2026-113727

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

Q: Which versions are affected?

Compare what you have installed with 1.0.0 → 1.0.6, 1.1.0 → 1.1.7, 1.2.0 → 1.2.5, >= 1.0.0, = 1.1.0, = 1.2.0, < 1.2.5. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

CWE-639: Authorization Bypass Through User-Controlled Key. EPSS 0.46%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Oct 20, 2026 · catalog updated Oct 23, 2026 · OpenChoreo: Authorization bypass on

Last checked Nov 3, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-113727. EPSS is 0.46%. Act only if a listed version of OpenChoreo: Authorization bypass on is installed.

Gaps on this record

The stored product name is a package slug. The name on this page is taken from the title (OpenChoreo: Authorization bypass on).
No vendor fix or required action is stored. Compare the linked advisory before you change production.

Severity: High7.4
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.46%
Remediation: Version ranges on file
Affected products: Go github.com/openchoreo/openchoreo · go github.com/openchoreo/openchoreo · golang github.com

## Summary The OpenChoreo API server authorized against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A 's membership in a project and component is carried entirely by its and labels. Because the check read those labels from the submitted object rather than the stored one, a caller holding on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels. The namespace is taken from the URL and feeds both the authorization check and the Kubernetes read, so it cannot diverge. This is cross-project and cross-component escalation inside a single namespace, not a cross-tenant issue. ## Impact Rewriting the ownership labels transfers authority over the run. Every other WorkflowRun check (view, logs, events, status, delete, list) derives its scope from the stored labels, so once the write lands the policy engine legitimately grants the attacker access to an object they never had rights to. They can then: - Read the victim's build logs. These stream raw pod logs from the workflow plane and routinely carry source paths, registry destinations, and credentials a build step echoed by accident. - Read the run's Kubernetes events. - Delete the run. So the primary impact is confidentiality and availability, not only integrity. On the integrity side, can be overwritten on a pending run, and manipulating the two ownership labels can either wedge the run in a permanent condition or downgrade it to a standalone run that skips component validation. Exploitation requires an authenticated caller with an or granting at project or component scope in the victim's namespace, plus knowledge of the target run's name. An anonymous caller cannot reach this. ## Patches The authorization check now loads the stored WorkflowRun and

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

Go github.com/openchoreo/openchoreo1.0.0 → 1.0.6
Go github.com/openchoreo/openchoreo1.1.0 → 1.1.7
Go github.com/openchoreo/openchoreo1.2.0 → 1.2.5
go github.com/openchoreo/openchoreo>= 1.0.0, < 1.0.6
go github.com/openchoreo/openchoreo>= 1.1.0, < 1.1.7
go github.com/openchoreo/openchoreo>= 1.2.0, < 1.2.5
golang github.comversion unspecified

How to fix CVE-2026-113727

Upgrade
CVE-2026-113727 lists a fix boundary at 1.0.6. Compare the installed build with that boundary before you change production.
Version check
Affected < 1.0.6
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-113727. EPSS is 0.46%. Act only if a listed version of OpenChoreo: Authorization bypass on is installed.

Which versions are affected?

Compare what you have installed with 1.0.0 → 1.0.6, 1.1.0 → 1.1.7, 1.2.0 → 1.2.5, >= 1.0.0, < 1.0.6, >= 1.1.0, < 1.1.7, >= 1.2.0, < 1.2.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-639: Authorization Bypass Through User-Controlled Key. EPSS 0.46%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Kubernetes security

Code

The project this record applies to. Exploit listings stay in References.

Repository · github.com

Timeline

Detection, updates, and resolution for this record.

Oct 21, 2026 · GitHub Advisory Database
Detected
## Summary The OpenChoreo API server authorized against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A 's membership in a project and component is carried entirely by its and labels. Because the check read those labels from the submitted object rather than the stored one, a caller holding on one
Oct 21, 2026 · GitHub Advisory Database
Fix available
github.com/openchoreo/openchoreo fixed in 1.0.6; github.com/openchoreo/openchoreo fixed in 1.1.7; github.com/openchoreo/openchoreo fixed in 1.2.5
Oct 21, 2026 · GitHub Advisory Database
Fix available
github.com/openchoreo/openchoreo fixed in 1.0.6
Oct 21, 2026 · GitHub Advisory Database
Fix available
github.com/openchoreo/openchoreo fixed in 1.1.7
Oct 21, 2026 · GitHub Advisory Database
Fix available
github.com/openchoreo/openchoreo fixed in 1.2.5
Oct 21, 2026 · GitHub Advisory Database
Updated
## Summary The OpenChoreo API server authorized against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A 's membership in a project and component is carried entirely by its and labels. Because the check read those labels from the submitted object rather than the stored one, a caller holding on one
Oct 23, 2026 · NIST NVD
Updated
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same na

Sources

CVE.orgVulnerability recordCVE-2026-113727
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-113727
30-day exploitation probability 0.46%
first.org
GitHub Advisory DatabasePackage advisoryGHSA-46r4-q7wv-32fc
GitHub Advisory Database record mirrored by OSV.
github.com
GitLab Advisory DatabasePackage advisoryCVE-2026-113727
The OpenChoreo API server authorized PUT …/workflowruns/{runName} against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried entirely by its openchoreo.dev/project and openchoreo.dev/component labels. Because the workflowrun:update
advisories.gitlab.com
Go Vulnerability DatabasePackage advisoryGHSA-46r4-q7wv-32fc
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
osv.dev
NIST NVDVulnerability recordCVE-2026-113727
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored
nvd.nist.gov
OpenSSF OSV / OSV ScannerPackage advisoryGHSA-46r4-q7wv-32fc
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
osv.dev

References

Freshness

Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

FIRST EPSSNov 3, 2026
Go Vulnerability DatabaseOct 24, 2026
GitLab Advisory DatabaseOct 23, 2026
GitHub Advisory DatabaseOct 23, 2026
OpenSSF OSV / OSV ScannerOct 23, 2026
NIST NVDOct 23, 2026
CVE.orgOct 21, 2026

Priority score

23/100

Evidence confidence: High

Several independent sources name this vulnerability.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity11/15
Public exploit0/10
Internet exposure6/10
Product prevalence5/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

High

CVSS severity
7.4 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
EPSS probability
0.46% · p40.01%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Version ranges on file
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.

Stacks

Go Kubernetes

Weakness

CWE-639
Authorization Bypass Through User-Controlled Key
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.