github.com/openchoreo/openchoreo

Go · Package

6 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runsCVE-2026-113727 · GHSA-46R4-Q7WV-32FCVersion ranges need review.	github.com/openchoreo/openchoreo	Go	High	Fix reported	2026-11-06
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIsCVE-2026-73843 · GHSA-QH9R-J7RP-4X2MVersion ranges need review.	github.com/openchoreo/openchoreo	Go	Critical	Fix reported	2026-09-10
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)CVE-2026-73840 · GHSA-C5F6-2RM9-2W8GVersion ranges need review.	github.com/openchoreo/openchoreo	Go	Medium	Fix reported	2026-09-10
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutationCVE-2026-73842 · GHSA-RH53-XVX2-J327Version ranges need review.	github.com/openchoreo/openchoreo	Go	Critical	Fix reported	2026-09-10
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged podsCVE-2026-73667 · GHSA-2MW5-23GM-PCCQVersion ranges need review.	github.com/openchoreo/openchoreo	Go	High	Fix reported	2026-09-10
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpointsCVE-2026-73841 · GHSA-52GF-6RPQ-FGMXVersion ranges need review.	github.com/openchoreo/openchoreo	Go	High	Fix reported	2026-09-10