DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-73840: CVE-2026-73840: Unauthenticated Webhook Signature Bypass and Git-Provider Confusion in OpenChoreo

#security #cve #cybersecurity

CVE-2026-73840: Unauthenticated Webhook Signature Bypass and Git-Provider Confusion in OpenChoreo

Vulnerability ID: CVE-2026-73840
CVSS Score: 5.3
Published: 2026-09-02

An authentication bypass and logical confusion vulnerability exists in the OpenChoreo Kubernetes developer platform webhook ingestion system. By exploiting a combination of git-provider spoofing, a missing signature validation requirement on Bitbucket webhooks, and a lack of source-host mapping checks, unauthenticated network attackers can trigger unauthorized builds on arbitrary repositories.

TL;DR

An unauthenticated remote attacker can trigger arbitrary builds on target Kubernetes repositories by spoofing Bitbucket webhook headers and bypassing signature validation checks due to logical flaws in the OpenChoreo handler.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-287
  • Attack Vector: Network
  • CVSS v3.1 Score: 5.3
  • EPSS Score: 0.00237
  • Impact Rating: Availability (Low)
  • Exploit Status: PoC in Tests
  • KEV Status: Not Listed

Affected Systems

  • OpenChoreo Kubernetes platform deployments utilizing auto-build features
  • OpenChoreo: < 1.0.3 (Fixed in: 1.0.3)
  • OpenChoreo: >= 1.1.0, < 1.1.3 (Fixed in: 1.1.3)
  • OpenChoreo: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: 1.2.0-rc.2)

Code Analysis

Commit: f540553

Implement Bitbucket signature validation and fix provider confusion logic

Commit: 268efd9

Backport fix for webhook signature bypass to release-v1.0

Commit: 8af4a3f

Backport fix for webhook signature bypass to release-v1.1

Mitigation Strategies

  • Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.
  • Enforce HMAC-SHA256 signatures for all webhook pipelines including Bitbucket integrations.
  • Restrict ingress path access to trusted IP ranges of external Git service providers.

Remediation Steps:

  1. Identify all OpenChoreo namespace installations within the Kubernetes cluster.
  2. Update deployment manifests to pull openchoreo images at version 1.0.3, 1.1.3, or higher.
  3. Generate strong random secrets for Bitbucket webhooks.
  4. Update the 'git-webhook-secrets' Kubernetes Secret to populate the 'bitbucket-secret' field.
  5. Configure the corresponding repositories on Bitbucket with the same secret and enable hook signatures.
  6. Verify pipeline triggers function properly and reject unsigned test payloads.

References

Read the full report for CVE-2026-73840 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)