OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs (CVE-2026-113727)

The OpenChoreo API server's PUT endpoint for updating WorkflowRuns authorized requests by checking ownership labels from the submitted request body instead of the stored object. Since the actual object mutated is selected by the URL path, this mismatch allowed an authenticated user with 'workflowrun:update' permission on one component to specify a WorkflowRun belonging to another project or component in the URL, supply labels for their own component in the request body, pass authorization, and overwrite the unrelated run's ownership labels. This cross-project and cross-component escalation within a single namespace enables the attacker to gain legitimate access to the victim's WorkflowRun, including reading build logs and Kubernetes events, deleting the run, and modifying workflow parameters. The vulnerability requires authenticated access with update permissions and knowledge of the target run's name. The issue is fixed by deriving ownership attributes from the stored WorkflowRun and making ownership labels immutable on update. Versions 1.0.0 through 1.0.5, 1.1.0 through 1.1.6, and 1.2.0 through 1.2.4 are affected, with fixes in 1.0.6, 1.1.7, and 1.2.5.

An attacker with authenticated access and 'workflowrun:update' permission on a component can escalate privileges within a namespace by rewriting ownership labels of WorkflowRuns belonging to other projects or components. This grants unauthorized read access to sensitive build logs containing potentially confidential information such as source paths and credentials, read access to Kubernetes events, and the ability to delete WorkflowRuns. Additionally, the attacker can manipulate workflow parameters and cause workflow runs to enter error states or bypass component validation. The impact affects confidentiality, integrity, and availability of WorkflowRun objects within the namespace.

A patch is available and should be applied by upgrading to OpenChoreo versions 1.0.6, 1.1.7, or 1.2.5 depending on the release line in use. No configuration changes are required after upgrading. If immediate upgrade is not possible, restrict the 'workflowrun:update' permission to trusted principals only by auditing and adjusting AuthzRole and ClusterAuthzRole bindings. Pay particular attention to roles such as 'workload-publisher' and 'admin' which include this permission. Treat credentials bound to these roles as highly privileged and protect them accordingly.