CVE-2026-73840 openchoreo CVE debrief

Who should care

Kubernetes administrators and users of OpenChoreo should assess their exposure to this vulnerability and verify that they are running a fixed version of the software. This includes reviewing the current deployment of OpenChoreo, identifying potential entry points for attackers, and ensuring that all necessary security measures are in place.

Why it matters

CVE-2026-73840 is a vulnerability in OpenChoreo that allows for unauthenticated build triggers, potentially leading to unauthorized builds, supply chain attacks, and denial-of-service attacks. Kubernetes administrators and users of OpenChoreo should assess their exposure and verify that they are running a fixed version of the software.

• Potential for unauthorized build triggers
• Risk of supply chain attacks through cross-provider triggers
• Need for verification of request authenticity
• Potential for denial-of-service attacks through excessive build requests

Technical summary

The POST /api/v1alpha1/autobuild endpoint in OpenChoreo's internal/openchoreo-api/api/handlers/webhook_handler.go file does not properly validate the X-Event-Key header, allowing for unauthenticated build triggers. The endpoint also accepts Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allows cross-provider triggers using attacker-supplied commit SHAs.

Defensive priority

Defenders should prioritize verifying the authenticity of requests to the /api/v1alpha1/autobuild endpoint and ensuring that only authorized users can trigger builds.

Recommended defensive actions

• Verify the authenticity of requests to the /api/v1alpha1/autobuild endpoint
• Ensure that only authorized users can trigger builds
• Upgrade to a fixed version of OpenChoreo (1.0.3, 1.1.3, or 1.2.0-rc.2)
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate that the vulnerability was fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2 of OpenChoreo. However, the exact scope of affected versions and the number of impacted users are unknown.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.