If you learned from my posts, inspired, or encouraged to grow in the cybersecurity and digital forensics, I would really appreciate your vote and support - Husam Shbib!
MyCyberNews

Search

Find merged stories by title or summary.

Vulnerabilities & Patches
Emerging1 src

CVE-2026-73840 - OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

CVE ID : CVE-2026-73840 Published : Aug. 13, 2026, 10:17 p. m. • 48 minutes ago Description : OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1. 0. 3, 1. 1. 3, and 1. 2. 0-rc. 2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler. go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1. 0. 3, 1. 1. 3, and 1. 2. 0-rc. 2. Severity: 5.3 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

·CVEFeed
Read →

You've reached the end of current stories for this search.