CVE-2026-113727 openchoreo CVE debrief

Who should care

Defenders responsible for OpenChoreo deployments, especially those with multiple projects and components, should assess their exposure to this vulnerability and prioritize remediation efforts to prevent potential cross-project takeovers.

Why it matters

The OpenChoreo API server has an authorization bypass vulnerability in the WorkflowRun update endpoint, allowing for cross-project takeover of workflow runs. Defenders should prioritize verifying exposure in their OpenChoreo deployments and assess the impact of this vulnerability on their systems.

• Defenders must verify OpenChoreo deployments for exposure and assess the impact on their systems.
• Remediation efforts should prioritize updating OpenChoreo to a fixed version.
• Monitoring of workflow runs is necessary to detect potential exploitation attempts.
• Verification of workflow run ownership and permissions is crucial to prevent unauthorized access.

Technical summary

The OpenChoreo API server does not properly validate the ownership of WorkflowRun objects during updates, allowing a caller with `workflowrun:update` permissions on one component to update runs in different projects or components by supplying matching labels. This issue is a cross-project and cross-component escalation within a single namespace. The vulnerability arises from the server's reliance on ownership metadata from the request body rather than the stored object. Defenders should prioritize verifying exposure in their OpenChoreo deployments, especially those with multiple projects and components, and assess the impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying exposure in their OpenChoreo deployments, especially those with multiple projects and components, and assess the impact of this vulnerability on their systems.

Recommended defensive actions

• Verify OpenChoreo deployments for exposure to this vulnerability, especially in multi-project and multi-component environments.
• Assess the impact of this vulnerability on OpenChoreo systems and prioritize remediation efforts accordingly.
• Update OpenChoreo to a version that includes the fix for this vulnerability, such as v1.0.6, v1.1.7, or v1.2.5.
• Monitor OpenChoreo workflow runs for suspicious activity that could indicate exploitation of this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability details are based on the OpenChoreo source item and related references provided. The impact of this vulnerability is limited to cross-project and cross-component escalation within a single namespace.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.