Vulnerability GO-2026-6825
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:54 PM UTC
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo
>=1.0.0 <1.0.6, >=1.1.0 <1.1.7, >=1.2.0 <1.2.5
>=1.0.0 <1.0.6, >=1.1.0 <1.1.7, >=1.2.0 <1.2.5
Summary
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo
Details
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
15 days ago
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
>=1.0.0 <1.0.6, >=1.1.0 <1.1.7, >=1.2.0 <1.2.5 GHSA-46r4-q7wv-32fc
>=1.0.0 <1.0.6, >=1.1.0 <1.1.7, >=1.2.0 <1.2.5 GHSA-46r4-q7wv-32fc
Unknown
1 month ago
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo
<1.0.4, >=1.1.0 <1.1.4, >=1.2.0-rc.1 <1.2.0-rc.2 GO-2026-6357
<1.0.4, >=1.1.0 <1.1.4, >=1.2.0-rc.1 <1.2.0-rc.2 GO-2026-6357
Unknown
1 month ago
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo
<1.1.6, >=1.2.0-m.1 <1.2.3 GO-2026-6358
<1.1.6, >=1.2.0-m.1 <1.2.3 GO-2026-6358
Unknown
1 month ago
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo
<1.0.3, >=1.1.0 <1.1.3, >=1.2.0-rc.1 <1.2.0-rc.2 GO-2026-6360
<1.0.3, >=1.1.0 <1.1.3, >=1.2.0-rc.1 <1.2.0-rc.2 GO-2026-6360
Unknown
1 month ago
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo
<1.0.2, >=1.1.0 <1.1.2 GO-2026-6362
<1.0.2, >=1.1.0 <1.1.2 GO-2026-6362
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:54 PM UTC
Fixed (v1.2.5)
2 months ago
September 07, 2026 at 06:18 AM UTC
Fixed (v1.1.7)
1 month ago
September 08, 2026 at 06:47 AM UTC
Fixed (v1.0.6)
1 month ago
September 08, 2026 at 09:32 AM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:15 PM UTC