01 Record

CVE-2026-73840

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

MediumPUBLISHEDCNA: GitHub_M

Base score5.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

02 Description

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

Published: 2026-08-13 21:52Z20 HR AGO
Last updated: 2026-08-14 16:26Z2 HR AGO
Reserved: 2026-08-13
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: Medium (CVSS 5.3)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-287 CWE-290 CWE-345
SSVC decision: ExploitationnoneAutomatableyesTechnical Impactpartial
Data version: 5.2
Document digest: 83842e677ebaf23295b6dfcd3a3268f31e57b5b1ad4ce591ec550eddd3e76b39

VendorProductVersionsPlatforms

openchoreoopenchoreo< 1.0.3, >= 1.1.0, < 1.1.3, >= 1.2.0-rc.1, < 1.2.0-rc.2—