Skip to content
OpenAdvisories

Vendor

openchoreo

7 known vulnerabilities.

Products

openchoreo 6 backstage-plugins 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-73840

    OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

    OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-contro…

    openchoreo openchoreo github.com/openchoreo/openchoreo Go