OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) (CVE-2026-73840)

The OpenChoreo autobuild webhook endpoint (`POST /api/v1alpha1/autobuild`) improperly selects the git provider for webhook authentication from a client-supplied header instead of the configured component provider. Additionally, the Bitbucket provider accepted webhook requests without verifying signatures, allowing an attacker to set the `X-Event-Key` header to impersonate Bitbucket and bypass HMAC secret validation used for GitHub and GitLab. This flaw enables unauthenticated triggering of builds on any auto-build component matching the repository URL and branch, regardless of tenant or namespace. The triggered build runs against an attacker-supplied commit SHA. The vulnerability affects any component with `spec.autoBuild: true` if the webhook endpoint is reachable. The issue is fixed in OpenChoreo versions 1.0.3, 1.1.3, and 1.2.0-rc.2 by enforcing HMAC-SHA256 validation for Bitbucket webhooks, requiring non-empty secrets for all providers, and ensuring the authenticated provider matches the component's configured git provider.

An attacker with network access to the autobuild webhook endpoint and knowledge of the repository URL and branch can trigger unauthorized builds without authentication. This can lead to unauthorized deployment of attacker-influenced code if auto-deploy is configured, and can also be used to exhaust build resources through repeated triggering. The vulnerability affects all auto-build components cluster-wide matching the repository and branch, regardless of tenant or namespace isolation.

A fix is available in OpenChoreo versions 1.0.3, 1.1.3, and 1.2.0-rc.2 and later. The fix enforces HMAC-SHA256 signature validation for Bitbucket webhooks, requires a configured non-empty secret for all git providers, and ensures the authenticated provider matches the component's configured provider. Users should upgrade to one of these fixed versions. The upgrade is non-disruptive and requires no changes to component or webhook configurations beyond the standard upgrade process.