Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-127081 (GCVE-0-2026-127081)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:32

Title

OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id

Summary

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 18:31 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/0f4aaf3d9ab999…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:31:37.112099Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:32:22.758Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project\u0027s environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:20.852Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/0f4aaf3d9ab99950c7f643546fd7d713"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-pipeline-stage-project-env-id"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127081",
    "datePublished": "2026-11-13T09:34:20.852Z",
    "dateReserved": "2026-11-12T14:12:10.282Z",
    "dateUpdated": "2026-11-13T18:32:22.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127080 (GCVE-0-2026-127080)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 22:30

Title

OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes

Summary

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 16:48 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/b8c1cf47f829c2…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127080",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T16:48:40.460621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T22:30:57.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:21.479Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/b8c1cf47f829c28086fe78d8187eb938"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-container-escape-via-unrestricted-hostpath-volumes"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127080",
    "datePublished": "2026-11-13T09:34:21.479Z",
    "dateReserved": "2026-11-12T14:12:09.969Z",
    "dateUpdated": "2026-11-13T22:30:57.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127079 (GCVE-0-2026-127079)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp

Summary

OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/c3c9d02c324a73…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target\u0027s password and taking over the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:22.100Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/c3c9d02c324a73937ca4db81f223435e"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-otp-brute-force-via-password-reset-check-otp"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127079",
    "datePublished": "2026-11-13T09:34:22.100Z",
    "dateReserved": "2026-11-12T14:12:09.595Z",
    "dateUpdated": "2026-11-13T09:34:22.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127078 (GCVE-0-2026-127078)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter

Summary

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/26f637bfda3513…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application\u0027s environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application\u0027s configuration, registries and deployment infrastructure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:22.785Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/26f637bfda3513ab255d8f8e46bcf8d1"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-project-env-id-parameter"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127078",
    "datePublished": "2026-11-13T09:34:22.785Z",
    "dateReserved": "2026-11-12T14:12:09.242Z",
    "dateUpdated": "2026-11-13T09:34:22.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127077 (GCVE-0-2026-127077)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:34

Title

OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API

Summary

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 18:33 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/e6ba937a2ea3f0…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:33:42.611024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:34:05.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project\u0027s cluster, then trigger builds and deployments into it, bypassing project isolation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:24.783Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/e6ba937a2ea3f06fc0a79bd6193e4574"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-environment-creation-api"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127077",
    "datePublished": "2026-11-13T09:34:24.783Z",
    "dateReserved": "2026-11-12T14:12:08.852Z",
    "dateUpdated": "2026-11-13T18:34:05.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127076 (GCVE-0-2026-127076)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 22:30

Title

OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API

Summary

OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 16:42 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/2c7f64bebb810f…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127076",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T16:42:55.474305Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T22:30:50.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects\u0027 source code, manifests, and committed secrets."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:25.444Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/2c7f64bebb810f565223b6916551df36"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-broken-access-control-via-git-repo-api"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127076",
    "datePublished": "2026-11-13T09:34:25.444Z",
    "dateReserved": "2026-11-12T14:12:08.491Z",
    "dateUpdated": "2026-11-13T22:30:50.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127075 (GCVE-0-2026-127075)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering

Summary

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/ce44dc92c964b4…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:26.178Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/ce44dc92c964b43008eb714343e4de82"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-additional-manifest-rendering"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127075",
    "datePublished": "2026-11-13T09:34:26.178Z",
    "dateReserved": "2026-11-12T14:12:08.127Z",
    "dateUpdated": "2026-11-13T09:34:26.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127074 (GCVE-0-2026-127074)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context

Summary

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/58e88fa3decf9e…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:26.848Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/58e88fa3decf9e0145bf28a4b61a394a"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-dockerfile-path-and-build-context"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127074",
    "datePublished": "2026-11-13T09:34:26.848Z",
    "dateReserved": "2026-11-12T14:12:07.767Z",
    "dateUpdated": "2026-11-13T09:34:26.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127073 (GCVE-0-2026-127073)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:34

Title

OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest

Summary

OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 18:34 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/7bc715e190e5be…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127073",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:34:34.459034Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:34:48.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:27.520Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/7bc715e190e5be2c2fc5be15c4035ce7"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-privilege-escalation-via-additional-manifest"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127073",
    "datePublished": "2026-11-13T09:34:27.520Z",
    "dateReserved": "2026-11-12T14:12:07.370Z",
    "dateUpdated": "2026-11-13T18:34:48.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127073 (GCVE-0-2026-127073)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:34

Title

OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest

Summary

OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 18:34 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/7bc715e190e5be…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127073",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:34:34.459034Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:34:48.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:27.520Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/7bc715e190e5be2c2fc5be15c4035ce7"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-privilege-escalation-via-additional-manifest"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127073",
    "datePublished": "2026-11-13T09:34:27.520Z",
    "dateReserved": "2026-11-12T14:12:07.370Z",
    "dateUpdated": "2026-11-13T18:34:48.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127074 (GCVE-0-2026-127074)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context

Summary

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/58e88fa3decf9e…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:26.848Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/58e88fa3decf9e0145bf28a4b61a394a"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-dockerfile-path-and-build-context"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127074",
    "datePublished": "2026-11-13T09:34:26.848Z",
    "dateReserved": "2026-11-12T14:12:07.767Z",
    "dateUpdated": "2026-11-13T09:34:26.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127075 (GCVE-0-2026-127075)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering

Summary

OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/ce44dc92c964b4…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:26.178Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/ce44dc92c964b43008eb714343e4de82"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-path-traversal-via-additional-manifest-rendering"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127075",
    "datePublished": "2026-11-13T09:34:26.178Z",
    "dateReserved": "2026-11-12T14:12:08.127Z",
    "dateUpdated": "2026-11-13T09:34:26.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127076 (GCVE-0-2026-127076)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 22:30

Title

OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API

Summary

OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 16:42 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/2c7f64bebb810f…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127076",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T16:42:55.474305Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T22:30:50.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects\u0027 source code, manifests, and committed secrets."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:25.444Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/2c7f64bebb810f565223b6916551df36"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-broken-access-control-via-git-repo-api"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127076",
    "datePublished": "2026-11-13T09:34:25.444Z",
    "dateReserved": "2026-11-12T14:12:08.491Z",
    "dateUpdated": "2026-11-13T22:30:50.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127077 (GCVE-0-2026-127077)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:34

Title

OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API

Summary

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 18:33 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/e6ba937a2ea3f0…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:33:42.611024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:34:05.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project\u0027s cluster, then trigger builds and deployments into it, bypassing project isolation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:24.783Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/e6ba937a2ea3f06fc0a79bd6193e4574"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-environment-creation-api"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127077",
    "datePublished": "2026-11-13T09:34:24.783Z",
    "dateReserved": "2026-11-12T14:12:08.852Z",
    "dateUpdated": "2026-11-13T18:34:05.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127078 (GCVE-0-2026-127078)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter

Summary

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/26f637bfda3513…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application\u0027s environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application\u0027s configuration, registries and deployment infrastructure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:22.785Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/26f637bfda3513ab255d8f8e46bcf8d1"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-project-env-id-parameter"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127078",
    "datePublished": "2026-11-13T09:34:22.785Z",
    "dateReserved": "2026-11-12T14:12:09.242Z",
    "dateUpdated": "2026-11-13T09:34:22.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127079 (GCVE-0-2026-127079)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp

Summary

OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/c3c9d02c324a73…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target\u0027s password and taking over the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:22.100Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/c3c9d02c324a73937ca4db81f223435e"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-otp-brute-force-via-password-reset-check-otp"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127079",
    "datePublished": "2026-11-13T09:34:22.100Z",
    "dateReserved": "2026-11-12T14:12:09.595Z",
    "dateUpdated": "2026-11-13T09:34:22.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127080 (GCVE-0-2026-127080)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 22:30

Title

OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes

Summary

OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 16:48 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/b8c1cf47f829c2…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127080",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T16:48:40.460621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T22:30:57.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:21.479Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/b8c1cf47f829c28086fe78d8187eb938"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-container-escape-via-unrestricted-hostpath-volumes"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127080",
    "datePublished": "2026-11-13T09:34:21.479Z",
    "dateReserved": "2026-11-12T14:12:09.969Z",
    "dateUpdated": "2026-11-13T22:30:57.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127081 (GCVE-0-2026-127081)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:32

Title

OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id

Summary

OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 18:31 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8194 records in the last 180 days details

References

3 references

URL	Tags
https://gist.github.com/neelkotnis/0f4aaf3d9ab999…	technical-descriptionexploit
https://www.buildpiper.io/	product
https://www.vulncheck.com/advisories/opstree-buil…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpsTree Solutions	BuildPiper	Affected: 0 , < 2.7.0 (semver)

Date Public

2026-11-12 00:00

Credits

Neel Saurabh Kotnis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:31:37.112099Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:32:22.758Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuildPiper",
          "vendor": "OpsTree Solutions",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neel Saurabh Kotnis"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project\u0027s environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:20.852Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/neelkotnis/0f4aaf3d9ab99950c7f643546fd7d713"
        },
        {
          "name": "BuildPiper Product Page",
          "tags": [
            "product"
          ],
          "url": "https://www.buildpiper.io/"
        },
        {
          "name": "VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-authorization-bypass-via-pipeline-stage-project-env-id"
        }
      ],
      "title": "OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127081",
    "datePublished": "2026-11-13T09:34:20.852Z",
    "dateReserved": "2026-11-12T14:12:10.282Z",
    "dateUpdated": "2026-11-13T18:32:22.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

18 vulnerabilities found for BuildPiper by OpsTree Solutions

CVE-2026-127081 (GCVE-0-2026-127081)

CVE-2026-127080 (GCVE-0-2026-127080)

CVE-2026-127079 (GCVE-0-2026-127079)

CVE-2026-127078 (GCVE-0-2026-127078)

CVE-2026-127077 (GCVE-0-2026-127077)

CVE-2026-127076 (GCVE-0-2026-127076)

CVE-2026-127075 (GCVE-0-2026-127075)

CVE-2026-127074 (GCVE-0-2026-127074)

CVE-2026-127073 (GCVE-0-2026-127073)

CVE-2026-127073 (GCVE-0-2026-127073)

CVE-2026-127074 (GCVE-0-2026-127074)

CVE-2026-127075 (GCVE-0-2026-127075)

CVE-2026-127076 (GCVE-0-2026-127076)

CVE-2026-127077 (GCVE-0-2026-127077)

CVE-2026-127078 (GCVE-0-2026-127078)

CVE-2026-127079 (GCVE-0-2026-127079)

CVE-2026-127080 (GCVE-0-2026-127080)

CVE-2026-127081 (GCVE-0-2026-127081)