Openchoreo

7 CVEs in 2 Openchoreo products, including Openchoreo, Backstage-Plugins. Newest: CVE-2026-113727 (2026-10-20).

Openchoreo products with known CVEs

ProductCVEs
Openchoreo7
Backstage-Plugins1
Openchoreo CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-113727High7.42026-10-20OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a reque…
CVE-2026-73843Critical9.62026-08-13OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing mana…
CVE-2026-73842Critical9.02026-08-13OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api…
CVE-2026-73841High8.82026-08-13OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/op…
CVE-2026-73840Medium5.32026-08-13OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in in…
CVE-2026-73667High8.82026-08-13OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under sampl…
CVE-2026-73666High8.22026-08-13OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisable…