EUVD-2026-58546
GHSA-c5f6-2rm9-2w8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed OpenChoreo autobuild endpoint
-
DeliveryEnumerate or guess valid repository URL and branch from public SCM
-
ExploitCraft POST with forged X-Event-Key selecting Bitbucket provider
-
ExecutionSupply attacker-chosen commit SHA in request body
-
PersistPlatform skips HMAC validation and accepts event
-
ImpactUnauthorized build pipeline executes against attacker-supplied commit
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The POST /api/v1alpha1/autobuild endpoint must be network-reachable by the attacker - a condition satisfied by any internet-facing OpenChoreo deployment without ingress restrictions on the API surface. The attacker must know or enumerate a valid repository URL and branch name that matches an existing component registered in the platform; without a matching component, the build trigger finds no target. No authentication credentials are required (CVSS PR:N confirms unauthenticated access). The X-Event-Key header is fully attacker-controlled, so any webhook provider type can be impersonated - exploitation is not limited to Bitbucket-configured components. Deployments where the autobuild endpoint is firewalled behind a VPN, private network, or strict ingress policy allowing only known SCM provider IPs are not exploitable remotely. |
| Impact | The vendor-assigned CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) captures only availability impact, which underrepresents the actual threat surface. The ability to trigger builds using attacker-supplied commit SHAs carries a meaningful integrity dimension: a pipeline that builds and potentially deploys an adversary-chosen commit can introduce unauthorized code into staging or production environments, which is an integrity impact beyond mere availability disruption. The CVSS integrity rating of N appears to reflect a narrow reading of the immediate API-layer effect rather than the downstream CI/CD consequence. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV, and no public POC has been identified, suggesting no confirmed active exploitation at time of analysis. Practically, the risk is highest for organizations with internet-facing OpenChoreo deployments where the autobuild endpoint is reachable from untrusted networks - in such configurations, the exploit requires only knowledge of a valid repository URL and branch, both of which are often public. The low attack complexity (AC:L) and zero authentication requirement (PR:N) mean the barrier to attempted exploitation is minimal once the endpoint is located. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted POST to /api/v1alpha1/autobuild with X-Event-Key set to a Bitbucket event type and a request body containing a known repository URL, branch name, and an arbitrary attacker-chosen commit SHA. Because no HMAC-SHA256 signature is required, the platform accepts the request and triggers a CI/CD build against the supplied commit. No public POC is known, but the attack requires only standard HTTP tooling given the low complexity and absence of any cryptographic prerequisite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Unauthenticated build triggering in OpenChoreo before v1.0.3, v1.1.3, and v1.2.0-rc.2 allows any remote attacker to fire CI/CD pipeline jobs without valid webhook credentials. The POST /api/v1alpha1/autobuild endpoint trusts the caller-controlled X-Event-Key header to select a webhook provider and does not enforce HMAC-SHA256 validation for Bitbucket events, permitting cross-provider spoofing and build triggers using attacker-supplied commit SHAs against any matched repository and branch. No public exploit is identified at time of analysis, and vendor-confirmed patches exist for all affected release lines.
RemediationAI
Upgrade to OpenChoreo v1.0.3, v1.1.3, or v1.2.0-rc.2 as appropriate for the deployed release line; these versions enforce HMAC-SHA256 signature validation on webhook events via the X-Hub-Signature header and require a configured bitbucket-secret for Bitbucket provider paths. Patched releases are available at https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3, https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3, and https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2. If immediate patching is not feasible, restrict network access to the POST /api/v1alpha1/autobuild endpoint at the ingress or API gateway layer, allowing only the published IP ranges of trusted SCM webhook providers (Bitbucket, GitHub, etc.) - note that IP allowlisting provides partial protection only, as shared provider CIDRs can be abused by other tenants on the same platform. Disabling the autobuild/webhook feature entirely until patching is complete is the safest compensating control where manual build triggers are operationally acceptable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenChoreo is an open-source Kubernetes developer platform with a webhook-driven autobuild subsystem. The vulnerability resides in internal/openchoreo-api/api/handlers/webhook_handler.go, where the HandleAutoBuild function used the HTTP header X-Event-Key - fully attacker-controlled - to resolve which webhook provider to invoke, rather than mapping providers from server-side configuration. For the Bitbucket provider path specifically, neither the X-Hub-Signature HMAC-SHA256 header nor a configured bitbucket-secret was required, meaning the server had no cryptographic means to verify that an inbound request originated from a legitimate Bitbucket webhook. The flaw is classified as CWE-287 (Improper Authentication): the system accepted trigger events and matched them to internal build components by repository URL and branch alone, without authenticating the event source. The commit diffs (268efd9, 8af4a3f, f540553) confirm the fix by adding X-Hub-Signature header parsing to HandleAutoBuildParams and enforcing HMAC-SHA256 validation in the server wrapper. No CPE string was supplied in the intelligence data; the affected software is the openchoreo/openchoreo GitHub project.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-accessible unauthenticated endpoint (AV:N/AC:L/PR:N/UI:N); triggering builds with attacker-supplied commit SHAs introduces integrity impact (I:L) absent from vendor scoring; no confidentiality impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB