EUVD-2026-105772

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs...

CVE-2026-113727

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...

CVE-2026-113727

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...

PT-2026-119042

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.6 OpenChoreo versions prior to 1.1.7 OpenChoreo versions prior to 1.2.5 Description An authorization flaw exists in the PUT ".../workflowruns/runName" endpoint. The system authorizes requests based on the...