CVE-2026-73840

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.3 OpenChoreo versions prior to 1.1.3 OpenChoreo versions prior to 1.2.0-rc.2

Description The 'POST /api/v1alpha1/autobuild' endpoint in 'internal/openchoreo-api/api/handlers/webhook handler.go' allows unauthenticated build triggers for components matched by repository URL and branch. The issue occurs because the system selects a webhook provider based on the caller-controlled X-Event-Key and accepts Bitbucket requests without a configured bitbucket-secret or a valid HMAC-SHA256 signature in the X-Hub-Signature. This enables cross-provider triggers using attacker-supplied commit SHAs.

Recommendations Update to version 1.0.3. Update to version 1.1.3. Update to version 1.2.0-rc.2.