—
GO-2026-6360
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo
Quick fix
GO-2026-6360 — github.com/openchoreo/openchoreo: upgrade to the fixed version with the command below.
go get github.com/openchoreo/openchoreo@v1.0.3Details
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/openchoreo/openchoreo
Introduced in:
0Fixed in: 1.0.3Fix
go get github.com/openchoreo/openchoreo@v1.0.3References
- https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-73840[ADVISORY]
- https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b[FIX]
- https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978[FIX]
- https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34[FIX]
- https://github.com/openchoreo/openchoreo/pull/4239[FIX]
- https://github.com/openchoreo/openchoreo/pull/4252[FIX]
- https://github.com/openchoreo/openchoreo/pull/4253[FIX]
- https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3[WEB]
- https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3[WEB]
- https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2[WEB]