EUVD-2026-58546Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-accessible unauthenticated endpoint (AV:N/AC:L/PR:N/UI:N); triggering builds with attacker-supplied commit SHAs introduces integrity impact (I:L) absent from vendor scoring; no confidentiality impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
AnalysisAI
Unauthenticated build triggering in OpenChoreo before v1.0.3, v1.1.3, and v1.2.0-rc.2 allows any remote attacker to fire CI/CD pipeline jobs without valid webhook credentials. The POST /api/v1alpha1/autobuild endpoint trusts the caller-controlled X-Event-Key header to select a webhook provider and does not enforce HMAC-SHA256 validation for Bitbucket events, permitting cross-provider spoofing and build triggers using attacker-supplied commit SHAs against any matched repository and branch. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The POST /api/v1alpha1/autobuild endpoint must be network-reachable by the attacker - a condition satisfied by any internet-facing OpenChoreo deployment without ingress restrictions on the API surface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) captures only availability impact, which underrepresents the actual threat surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends a crafted POST to /api/v1alpha1/autobuild with X-Event-Key set to a Bitbucket event type and a request body containing a known repository URL, branch name, and an arbitrary attacker-chosen commit SHA. Because no HMAC-SHA256 signature is required, the platform accepts the request and triggers a CI/CD build against the supplied commit. … |
| Remediation | Upgrade to OpenChoreo v1.0.3, v1.1.3, or v1.2.0-rc.2 as appropriate for the deployed release line; these versions enforce HMAC-SHA256 signature validation on webhook events via the X-Hub-Signature header and require a configured bitbucket-secret for Bitbucket provider paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today