OpenChoreo: autobuild webhook picks its provider from a caller-supplied header and accepts unsigned Bitbucket requests

Impact

The autobuild endpoint selects its webhook provider from the caller-controlled X-Event-Key header and accepts Bitbucket-shaped requests with no HMAC-SHA256 signature and no configured bitbucket-secret, so an unauthenticated caller who can reach the API can trigger builds for any component it can name by repository URL and branch, including cross-provider triggers carrying attacker-supplied commit SHAs. On a cluster where builds run on the same fleet as workloads, that is unauthenticated consumption of build capacity and a way to push chosen commit SHAs through the build pipeline. The vendor scores the impact as availability-only, which matches an abuse-of-capacity read rather than a code-execution one.

Who can reach it

Anyone who can reach the OpenChoreo API endpoint over the network, with no authentication and no webhook secret. Exposure depends entirely on whether the API is published beyond the cluster or the management VLAN.

What to do

Upgrade to OpenChoreo 1.0.3, 1.1.3 or 1.2.0-rc.2 depending on branch; the fix is a rolling restart of the openchoreo-api deployment, not a node operation. Until patched, restrict network reach to the autobuild endpoint to the SCM provider's published egress ranges and configure the Bitbucket webhook secret.

References

Related entries

• DMTF libspdm CSR generation under the mbedTLS crypto backend (cryptlib_mbedtls): Stack corruption inside the firmwareNCVD-2026-006-dmtf-libspdm-csr-generation-unde · DMTF libspdm CSR generation under the mbedTLS crypto backend (cryptlib_mbedtls)Medium
• DMTF libspdm responder handling of GET_MEASUREMENT_EXTENSION_LOG: A requester reads memory it was never authorisedNCVD-2026-007-dmtf-libspdm-responder-handling · DMTF libspdm responder handling of GET_MEASUREMENT_EXTENSION_LOGMedium
• rclone (rc server, /debug/pprof handler): The pprof debug handler is mounted as its own route on the rcloneNCVD-2026-041-rclone-rc-server-debug-pprof-han · rclone (rc server, /debug/pprof handler)Medium
• Keycloak: OIDC authentication flaw - attacker reusing data from a same-realm request impersonates a userCVE-2023-0264 · KeycloakMedium
• MySQL Server: InnoDB flaw allowing a high-privileged network attacker to cause a repeatable DoSCVE-2022-21417 · MySQL ServerMedium
• MySQL Server: InnoDB flaw - a high-privileged network attacker can hang or repeatedly crash the serverCVE-2023-22084 · MySQL ServerMedium