Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/openchoreo/openchoreo

6 known vulnerabilities (2 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
v1.3.3 (Oct 29, 2026): no advisory affects it
Newest unaffected release
v1.3.3 (Oct 29, 2026), the latest release
Advisories
6 · 2 critical, 3 high, 1 medium
Releases
60 since v0.0.0 (Apr 7, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-113727
    Affects v1.0.0 to v1.0.5 (v1.0.6 is outside it); v1.1.0 to v1.1.6 (v1.1.7 is outside it); v1.2.0 to v1.2.4 (v1.2.5 is outside it)
  • CVE-2026-73843
    Affects v0.0.0 to v1.0.1 (v1.0.2 is outside it); v1.1.0 to v1.1.1 (v1.1.2 is outside it)
  • CVE-2026-73842
    Affects v0.0.0 to v1.0.2 (v1.0.3 is outside it); v1.1.0 to v1.1.2 (v1.1.3 is outside it); v1.2.0-rc.1 to v1.2.0-rc.2 (v1.2.0 is outside it)
  • CVE-2026-73841
    Affects v0.0.0 to v1.1.5 (v1.1.6 is outside it); v1.2.0-m.1 to v1.2.2 (v1.2.3 is outside it)
  • CVE-2026-73840
    Affects v0.0.0 to v1.0.2 (v1.0.3 is outside it); v1.1.0 to v1.1.2 (v1.1.3 is outside it); v1.2.0-rc.1 (v1.2.0-rc.2 is outside it)
  • CVE-2026-73667
    Affects v0.0.0 to v1.0.3 (v1.0.4 is outside it); v1.1.0 to v1.1.3 (v1.1.4 is outside it); v1.2.0-rc.1 (v1.2.0-rc.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

    Affected: from 1.0.0, fixed in 1.0.6; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.5; from 1.0.0, fixed in 1.0.6; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.5.

    Fixed in v1.0.6 (released Sep 8, 2026, 42 days before disclosure), v1.1.7 (released Sep 8, 2026, 42 days before disclosure) and v1.2.5 (released Sep 7, 2026, 43 days before disclosure).

    The latest release, v1.3.3, is not affected.

  • CVE-2026-73843Critical 9.6

    OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

    Affected: fixed in 1.0.2; from 1.1.0, fixed in 1.1.2; fixed in 1.0.2; from 1.1.0, fixed in 1.1.2.

    Fixed in v1.0.2 (released Jul 8, 2026, 36 days before disclosure) and v1.1.2 (released Jul 8, 2026, 36 days before disclosure).

    The latest release, v1.3.3, is not affected.

  • CVE-2026-73842Critical 9.0

    OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and…

    Affected: fixed in 1.0.3; from 1.1.0, fixed in 1.1.3; from 1.2.0-rc.1, fixed in 1.2.0; fixed in 1.0.3; from 1.1.0, fixed in 1.1.3; from 1.2.0-rc.1, fixed in 1.2.0.

    Fixed in v1.0.3 (released Jul 22, 2026, 22 days before disclosure), v1.1.3 (released Jul 22, 2026, 22 days before disclosure) and v1.2.0 (released Jul 24, 2026, 20 days before disclosure).

    The latest release, v1.3.3, is not affected.

  • OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

    Affected: fixed in 1.1.6; from 1.2.0-m.1, fixed in 1.2.3; from 1.2.0-m.1, fixed in 1.2.3; fixed in 1.1.6.

    Fixed in v1.1.6 (released Aug 21, 2026, 8 days after disclosure) and v1.2.3 (released Aug 20, 2026, 7 days after disclosure).

    The latest release, v1.3.3, is not affected.

  • CVE-2026-73840Medium 5.3

    OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

    Affected: fixed in 1.0.3; from 1.1.0, fixed in 1.1.3; from 1.2.0-rc.1, fixed in 1.2.0-rc.2; fixed in 1.0.3; from 1.1.0, fixed in 1.1.3; from 1.2.0-rc.1, fixed in 1.2.0-rc.2.

    Fixed in v1.0.3 (released Jul 22, 2026, 22 days before disclosure), v1.1.3 (released Jul 22, 2026, 22 days before disclosure) and v1.2.0-rc.2 (released Jul 23, 2026, 21 days before disclosure).

    The latest release, v1.3.3, is not affected.

  • OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

    Affected: fixed in 1.0.4; from 1.1.0, fixed in 1.1.4; from 1.2.0-rc.1, fixed in 1.2.0-rc.2; fixed in 1.0.4; from 1.1.0, fixed in 1.1.4; from 1.2.0-rc.1, fixed in 1.2.0-rc.2.

    Fixed in v1.0.4 (released Jul 23, 2026, 21 days before disclosure), v1.1.4 (released Jul 23, 2026, 21 days before disclosure) and v1.2.0-rc.2 (released Jul 23, 2026, 21 days before disclosure).

    The latest release, v1.3.3, is not affected.