{"vulnerability": "GHSA-c5f6-2rm9-2w8g", "sightings": [{"uuid": "ede6bc95-c5b9-4072-8040-69fb54ebb5ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-c5f6-2rm9-2w8g", "type": "seen", "source": "https://gist.github.com/alon710/334e1eb2f1175b3ba4114070f1401a17", "content": "# CVE-2026-73840: CVE-2026-73840: Unauthenticated Webhook Signature Bypass and Git-Provider Confusion in OpenChoreo\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73840\n\n## Summary\nAn authentication bypass and logical confusion vulnerability exists in the OpenChoreo Kubernetes developer platform webhook ingestion system. By exploiting a combination of git-provider spoofing, a missing signature validation requirement on Bitbucket webhooks, and a lack of source-host mapping checks, unauthenticated network attackers can trigger unauthorized builds on arbitrary repositories.\n\n## TL;DR\nAn unauthenticated remote attacker can trigger arbitrary builds on target Kubernetes repositories by spoofing Bitbucket webhook headers and bypassing signature validation checks due to logical flaws in the OpenChoreo handler.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: 0.00237\n- **Impact Rating**: Availability (Low)\n- **Exploit Status**: PoC in Tests\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenChoreo Kubernetes platform deployments utilizing auto-build features\n- **OpenChoreo**: < 1.0.3 (Fixed in: `1.0.3`)\n- **OpenChoreo**: >= 1.1.0, < 1.1.3 (Fixed in: `1.1.3`)\n- **OpenChoreo**: >= 1.2.0-rc.1, < 1.2.0-rc.2 (Fixed in: `1.2.0-rc.2`)\n\n## Mitigation\n\n- Upgrade OpenChoreo deployment to version 1.0.3, 1.1.3, or 1.2.0-rc.2.\n- Enforce HMAC-SHA256 signatures for all webhook pipelines including Bitbucket integrations.\n- Restrict ingress path access to trusted IP ranges of external Git service providers.\n\n**Remediation Steps:**\n1. Identify all OpenChoreo namespace installations within the Kubernetes cluster.\n2. Update deployment manifests to pull openchoreo images at version 1.0.3, 1.1.3, or higher.\n3. Generate strong random secrets for Bitbucket webhooks.\n4. Update the 'git-webhook-secrets' Kubernetes Secret to populate the 'bitbucket-secret' field.\n5. Configure the corresponding repositories on Bitbucket with the same secret and enable hook signatures.\n6. Verify pipeline triggers function properly and reject unsigned test payloads.\n\n## References\n\n- [NVD - CVE-2026-73840](https://nvd.nist.gov/vuln/detail/CVE-2026-73840)\n- [GitHub Security Advisory GHSA-c5f6-2rm9-2w8g](https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73840) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T01:32:19.696690Z"}]}