# github.com/openchoreo/openchoreo (Go) vulnerabilities 6 known vulnerabilities (2 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.3.3 (Oct 29, 2026): no advisory affects it - Newest unaffected release: v1.3.3 (Oct 29, 2026), the latest release - Releases: 60 since v0.0.0 (Apr 7, 2025) - Registry: https://pkg.go.dev/github.com/openchoreo/openchoreo - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-113727: v1.0.0 to v1.0.5 (v1.0.6 is outside it); v1.1.0 to v1.1.6 (v1.1.7 is outside it); v1.2.0 to v1.2.4 (v1.2.5 is outside it) - CVE-2026-73843: v0.0.0 to v1.0.1 (v1.0.2 is outside it); v1.1.0 to v1.1.1 (v1.1.2 is outside it) - CVE-2026-73842: v0.0.0 to v1.0.2 (v1.0.3 is outside it); v1.1.0 to v1.1.2 (v1.1.3 is outside it); v1.2.0-rc.1 to v1.2.0-rc.2 (v1.2.0 is outside it) - CVE-2026-73841: v0.0.0 to v1.1.5 (v1.1.6 is outside it); v1.2.0-m.1 to v1.2.2 (v1.2.3 is outside it) - CVE-2026-73840: v0.0.0 to v1.0.2 (v1.0.3 is outside it); v1.1.0 to v1.1.2 (v1.1.3 is outside it); v1.2.0-rc.1 (v1.2.0-rc.2 is outside it) - CVE-2026-73667: v0.0.0 to v1.0.3 (v1.0.4 is outside it); v1.1.0 to v1.1.3 (v1.1.4 is outside it); v1.2.0-rc.1 (v1.2.0-rc.2 is outside it) ## Advisories (6) ### [CVE-2026-113727](https://cve.now/CVE-2026-113727): OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs - Severity: High 7.4 - Published: Oct 20, 2026 - Affected: from 1.0.0, fixed in 1.0.6; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.5; from 1.0.0, fixed in 1.0.6; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.5. - Fixed in v1.0.6 (released Sep 8, 2026, 42 days before disclosure), v1.1.7 (released Sep 8, 2026, 42 days before disclosure) and v1.2.5 (released Sep 7, 2026, 43 days before disclosure). - The latest release, v1.3.3, is not affected. ### [CVE-2026-73843](https://cve.now/CVE-2026-73843): OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs - Severity: Critical 9.6 - Published: Aug 13, 2026 - Affected: fixed in 1.0.2; from 1.1.0, fixed in 1.1.2; fixed in 1.0.2; from 1.1.0, fixed in 1.1.2. - Fixed in v1.0.2 (released Jul 8, 2026, 36 days before disclosure) and v1.1.2 (released Jul 8, 2026, 36 days before disclosure). - The latest release, v1.3.3, is not affected. ### [CVE-2026-73842](https://cve.now/CVE-2026-73842): OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and… - Severity: Critical 9.0 - Published: Aug 13, 2026 - Affected: fixed in 1.0.3; from 1.1.0, fixed in 1.1.3; from 1.2.0-rc.1, fixed in 1.2.0; fixed in 1.0.3; from 1.1.0, fixed in 1.1.3; from 1.2.0-rc.1, fixed in 1.2.0. - Fixed in v1.0.3 (released Jul 22, 2026, 22 days before disclosure), v1.1.3 (released Jul 22, 2026, 22 days before disclosure) and v1.2.0 (released Jul 24, 2026, 20 days before disclosure). - The latest release, v1.3.3, is not affected. ### [CVE-2026-73841](https://cve.now/CVE-2026-73841): OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints - Severity: High 8.8 - Published: Aug 13, 2026 - Affected: fixed in 1.1.6; from 1.2.0-m.1, fixed in 1.2.3; from 1.2.0-m.1, fixed in 1.2.3; fixed in 1.1.6. - Fixed in v1.1.6 (released Aug 21, 2026, 8 days after disclosure) and v1.2.3 (released Aug 20, 2026, 7 days after disclosure). - The latest release, v1.3.3, is not affected. ### [CVE-2026-73840](https://cve.now/CVE-2026-73840): OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) - Severity: Medium 5.3 - Published: Aug 13, 2026 - Affected: fixed in 1.0.3; from 1.1.0, fixed in 1.1.3; from 1.2.0-rc.1, fixed in 1.2.0-rc.2; fixed in 1.0.3; from 1.1.0, fixed in 1.1.3; from 1.2.0-rc.1, fixed in 1.2.0-rc.2. - Fixed in v1.0.3 (released Jul 22, 2026, 22 days before disclosure), v1.1.3 (released Jul 22, 2026, 22 days before disclosure) and v1.2.0-rc.2 (released Jul 23, 2026, 21 days before disclosure). - The latest release, v1.3.3, is not affected. ### [CVE-2026-73667](https://cve.now/CVE-2026-73667): OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods - Severity: High 8.8 - Published: Aug 13, 2026 - Affected: fixed in 1.0.4; from 1.1.0, fixed in 1.1.4; from 1.2.0-rc.1, fixed in 1.2.0-rc.2; fixed in 1.0.4; from 1.1.0, fixed in 1.1.4; from 1.2.0-rc.1, fixed in 1.2.0-rc.2. - Fixed in v1.0.4 (released Jul 23, 2026, 21 days before disclosure), v1.1.4 (released Jul 23, 2026, 21 days before disclosure) and v1.2.0-rc.2 (released Jul 23, 2026, 21 days before disclosure). - The latest release, v1.3.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/openchoreo/openchoreo Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.