OpenChoreo versions before 1.0.3, 1.1.3, and 1.2.0‑rc.2 allow an unauthenticated POST to the /api/v1alpha1/autobuild endpoint to trigger builds. The selected webhook provider is determined by the caller‑controlled X-Event-Key header and Bitbucket webhooks are accepted even without HMAC‑SHA256 validation or a configured bitbucket‑secret. By supplying a repository URL and branch, and optionally any commit SHA, an attacker can trigger a build of a component. This flaw is an authentication bypass (CWE‑287, CWE‑290) and permits improper data integrity handling (CWE‑345).

The vulnerability affects the openchoreo:openchoreo platform. All releases prior to v1.0.3, v1.1.3, and v1.2.0‑rc.2 are vulnerable. The problem is resolved in those releases and later versions.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST to a publicly reachable webhook endpoint; no additional prerequisites are described. Once a build is triggered, the attacker could cause unintended changes during the build process, although arbitrary code execution or full cluster compromise is not documented in the input description.