Vulnerability GO-2026-6360
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
September 10, 2026 at 02:48 PM UTC
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo
<1.0.3, >=1.1.0 <1.1.3, >=1.2.0-rc.1 <1.2.0-rc.2
<1.0.3, >=1.1.0 <1.1.3, >=1.2.0-rc.1 <1.2.0-rc.2
Summary
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo
Details
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
9 hours ago
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo
>=1.0.0 <1.0.6, >=1.1.0 <1.1.7, >=1.2.0 <1.2.5 GO-2026-6825
>=1.0.0 <1.0.6, >=1.1.0 <1.1.7, >=1.2.0 <1.2.5 GO-2026-6825
High Risk
15 days ago
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
>=1.0.0 <1.0.6, >=1.1.0 <1.1.7, >=1.2.0 <1.2.5 GHSA-46r4-q7wv-32fc
>=1.0.0 <1.0.6, >=1.1.0 <1.1.7, >=1.2.0 <1.2.5 GHSA-46r4-q7wv-32fc
Unknown
1 month ago
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo
<1.0.4, >=1.1.0 <1.1.4, >=1.2.0-rc.1 <1.2.0-rc.2 GO-2026-6357
<1.0.4, >=1.1.0 <1.1.4, >=1.2.0-rc.1 <1.2.0-rc.2 GO-2026-6357
Unknown
1 month ago
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo
<1.1.6, >=1.2.0-m.1 <1.2.3 GO-2026-6358
<1.1.6, >=1.2.0-m.1 <1.2.3 GO-2026-6358
Unknown
1 month ago
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo
<1.0.2, >=1.1.0 <1.1.2 GO-2026-6362
<1.0.2, >=1.1.0 <1.1.2 GO-2026-6362
Impacted packages
Timeline
Published
1 month ago
September 10, 2026 at 02:48 PM UTC
Fixed (v1.1.3)
3 months ago
July 22, 2026 at 08:56 AM UTC
Fixed (v1.0.3)
3 months ago
July 22, 2026 at 09:11 AM UTC
Fixed (v1.2.0-rc.2)
3 months ago
July 23, 2026 at 05:09 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:15 PM UTC