OpenChoreo: autobuild webhook picks its provider from a caller-supplied header and accepts unsigned Bitbucket requests

Impact

The autobuild endpoint selects its webhook provider from the caller-controlled X-Event-Key header and accepts Bitbucket-shaped requests with no HMAC-SHA256 signature and no configured bitbucket-secret, so an unauthenticated caller who can reach the API can trigger builds for any component it can name by repository URL and branch, including cross-provider triggers carrying attacker-supplied commit SHAs. On a cluster where builds run on the same fleet as workloads, that is unauthenticated consumption of build capacity and a way to push chosen commit SHAs through the build pipeline. The vendor scores the impact as availability-only, which matches an abuse-of-capacity read rather than a code-execution one.

Who can reach it

Anyone who can reach the OpenChoreo API endpoint over the network, with no authentication and no webhook secret. Exposure depends entirely on whether the API is published beyond the cluster or the management VLAN.

What to do

Upgrade to OpenChoreo 1.0.3, 1.1.3 or 1.2.0-rc.2 depending on branch; the fix is a rolling restart of the openchoreo-api deployment, not a node operation. Until patched, restrict network reach to the autobuild endpoint to the SCM provider's published egress ranges and configure the Bitbucket webhook secret.

References

Related entries

• GitLab CE/EE: improper authorization on internal endpoints exposes credentials and tokensCVE-2026-82837 · GitLab CE/EE (internal data emission endpoints, authorization)Medium
• openstack-network-exporter: missing HTTP header timeouts let an unauthenticated attacker exhaust file descriptorsCVE-2026-83536 · openstack-network-exporter (Prometheus metrics HTTP server)Medium
• GitLab CE/EE: incorrect authorization lets an unauthenticated user read work items in private groups and projectsCVE-2026-84284 · GitLab CE/EE (work item authorization)Medium
• Ansible automation-controller: Bitbucket DC webhook ping skips HMAC check, enumerating webhook-enabled templatesCVE-2026-84717 · Red Hat Ansible Automation Platform automation-controller (Bitbucket Data Center webhook receiver)Medium
• GitLab CE/EE: GraphQL authorization flaw exposes internal and confidential system notes on public projectsCVE-2026-85529 · GitLab CE/EE (GraphQL API, internal and confidential system notes)Medium
• Checkmk REST API: host configuration GET responses return SNMP and IPMI credentials in clear textCVE-2026-92882 · Checkmk REST API (host and folder configuration endpoints)Medium