Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🟠 OpenChoreo, Authentication Bypass, #CVE-2026-73840 (Medium) -DC-Sep2026-2136 https://dailycve.com/openchoreo-authentication-bypass-cve-2026-73840-medium-dc-sep2026-2136/
Post summary
The text announces an authentication bypass vulnerability (CVE-2026-73840) in OpenChoreo, rated Medium CVSS, without mentioning any PoC, exploit tool, or active exploitation.
CVE-2026-73840 OpenChoreo API Allows Unauthenticated Build Triggers via Webhook https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73840
Post summary
The text is a brief disclosure that OpenChoreo’s API allows unauthenticated build triggers via webhooks, but it lacks further technical detail, PoC, or exploitation information.