Openchoreo vulnerabilities
Products
Newest
- openchoreo OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs 7.4 High
- openchoreo OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs 9.6 Critical
- openchoreo OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation 9.0 Critical
- openchoreo OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints 8.8 High
- openchoreo OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) 5.3 Medium
- openchoreo OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods 8.8 High
- openchoreo backstage-plugins OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete 8.2 High