---
id: CVE-2026-113727
title: >-
  OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project
  takeover of workflow runs
summary: >-
  OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6,
  1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a
  request using the openchoreo.dev/project and openchoreo.dev/component labels
  in the…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-639
vendor: openchoreo
product: openchoreo
affected:
  - 'openchoreo >= 1.0.0, < 1.0.6'
  - 'openchoreo >= 1.1.0, < 1.1.7'
  - 'openchoreo >= 1.2.0, < 1.2.5'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T21:08:37.372Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113727'
references:
  - url: >-
      https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc
    label: >-
      https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc
  - url: 'https://github.com/openchoreo/openchoreo/pull/4596'
    label: 'https://github.com/openchoreo/openchoreo/pull/4596'
  - url: 'https://github.com/openchoreo/openchoreo/pull/4618'
    label: 'https://github.com/openchoreo/openchoreo/pull/4618'
  - url: 'https://github.com/openchoreo/openchoreo/pull/4626'
    label: 'https://github.com/openchoreo/openchoreo/pull/4626'
  - url: 'https://github.com/openchoreo/openchoreo/pull/4627'
    label: 'https://github.com/openchoreo/openchoreo/pull/4627'
  - url: >-
      https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca
    label: >-
      https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca
  - url: >-
      https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb
    label: >-
      https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb
  - url: >-
      https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14
    label: >-
      https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14
  - url: >-
      https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426
    label: >-
      https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426
  - url: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6'
    label: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6'
  - url: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7'
    label: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7'
  - url: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5'
    label: 'https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5'
tags:
  - cve.org
ingestedAt: '2026-10-20T21:19:21.141Z'
---

## Overview

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.

## Affected

- `openchoreo >= 1.0.0, < 1.0.6`
- `openchoreo >= 1.1.0, < 1.1.7`
- `openchoreo >= 1.2.0, < 1.2.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.